Pierluigi Paganini May 03, 2018

Microsoft released an out of band update to address a critical remote code execution vulnerability in the Windows Host Compute Service Shim library (hcsshim).

Microsoft announced that it has issued a security update to address a critical remote code execution vulnerability in the Windows Host Compute Service Shim library (hcsshim).

The Windows Host Compute Service (HCS) is a low-level container management API in Hyper-V, Microsoft implemented two open source wrappers to invoke HCS functions using higher level programming languages.

The Windows Host Compute Service Shim wrapper, introduced in January 2017, allows the launch of Windows Server containers from the Go language.

“We’ve released two wrappers thus far.  One is written in Go (and used by Docker), and the other is written in C#.” reads a blog post published by Microsoft.

“You can find the wrappers here:

• https://github.com/microsoft/dotnet-computevirtualization
• https://github.com/microsoft/hcsshim“

The security expert Michael Hanselmann discovered that hcsshim fails to properly validate input when importing a container image, the vulnerability, tracked as CVE-2018-8115, could be exploited by a remote attacker to execute arbitrary code on the host operating system.

“A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input while importing a container image.” reads the security advisory published by Microsoft.

“To exploit the vulnerability, an attacker would place malicious code in a specially crafted container image which, if an authenticated administrator imported (pulled), could cause a container management service utilizing the Host Compute Service Shim library to execute malicious code on the Windows host.”

While US-CERT has released an alert urging to update the library, Microsoft tried to downplay the problem explaining that it is unlikely that the flaw could be exploited in attacks in the wild.

Microsoft addressed the vulnerability with the out-of-band update hcsshim 0.6.10 that is available on GitHub.

Pierluigi Paganini

(Security Affairs – Windows Host Compute Service Shim library, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]