[Docker] 이미지 취약점 분석을 위한 Clair 설치 및 이용 방법

이번 시간에는 도커에서 이미지 사용시 해당 이미지가 보안에 취약한지 궁금할때가 있다.
이때 보안 취약점을 검토할 수 있는 오픈 소스 프로젝트 Clair의 실습을 진행하도록 한다!
Clair 이미지의 경우 데이터 베이스 포함된 이미지가 있으나 해당 이미지로 띄울시 CVE(정보보안 표준 취약점) 관련 데이터 소스를 가져와 데이터 베이스에 데이터를 채우는데 20-30분이 걸린다고 한다.
그래서 이를 해결하기 위해 Clair 데이터 베이스, 서버 분리된 이미지가 나왔으며
Clair 데이터 베이스 이미지는  배치로 매일 최신 취약점 데이터를 받아 데이터베이스(postgre)에 저장하며 갱신된 날짜 태그로 이미지가 올라간다.
그러므로 매일 갱신된 데이터로 분석하고 싶다면 Clair 데이터 베이스 이미지를 latest 태그로 매일 불러오면 된다. 
위와 같은 이유로 우리는 Clair 데이터 베이스, 서버가 분리된 이미지를 사용하도록 한다.
아키텍쳐는 아래와 같으며 clair-client 를 통해 clair-server와 통신하며, clair-server는 취약점 정보를 clair-db 로 부터 가져와 대상 이미지의 취약점을 분석한다.

자세한 설명은 아래 표를 참고한다.

설치 항목	내용
Clair DB (postgreDB)	CVE(정보보안 표준 취약점) 저장, 취약점 스캔 결과 저장
Clair Server	클레어 서버(취약점 업데이트 수행, Rest API로 업데이트 수행 및 클라이언트와 통신)
Clair Client(=Scanner)	클레어 클라이언트로 실제 사용자가 분석시 사용

이제 설치를 진행해보자!
우선 DB 를 설치한다!

$ docker run -p 5432:5432 -d --name db arminc/clair-db:latest

그 다음은 서버!

$ docker run -p 6060:6060 --link db:postgres -d --name clair arminc/clair-local-scan:latest

정상적으로 컨테이너가 떠있다.

$ docker ps -a
CONTAINER ID   IMAGE                            COMMAND                  CREATED             STATUS                           PORTS                                                 NAMES
687fc5e3718c   arminc/clair-local-scan:latest   "/clair -config=/con…"   10 seconds ago      Up 9 seconds                     0.0.0.0:6060->6060/tcp, :::6060->6060/tcp, 6061/tcp   clair
9cbcbae80061   arminc/clair-db:latest           "docker-entrypoint.s…"   About an hour ago   Up About an hour                 0.0.0.0:5432->5432/tcp, :::5432->5432/tcp             db

마지막으로 스캐너를 설치한다!

$ wget https://github.com/arminc/clair-scanner/releases/download/v12/clair-scanner_linux_amd64
$ chmod +x clair-scanner_linux_amd64; sudo mv clair-scanner_linux_amd64 /usr/local/bin/clair-scanner

 
정상적으로 클라이언트 명령어 호출이 가능한것을 볼 수 있으며 콘솔에 옵션에 대한 내용이 나온김에 옵션에 대해 알아보자!

$ clair-scanner
Error: incorrect usage

Usage: clair-scanner [OPTIONS] IMAGE

Scan local Docker images for vulnerabilities with Clair

Arguments:
  IMAGE=""     Name of the Docker image to scan
  Options:
  -w, --whitelist=""                    Path to the whitelist file
  -t, --threshold="Unknown"             CVE severity threshold. Valid values; 'Defcon1', 'Critical', 'High', 'Medium', 'Low', 'Negligible', 'Unknown'
  -c, --clair="http://127.0.0.1:6060"   Clair URL
  --ip="localhost"                      IP address where clair-scanner is running on
  -l, --log=""                          Log to a file
  --all, --reportAll=true               Display all vulnerabilities, even if they are approved
  -r, --report=""                       Report output file, as JSON
  --exit-when-no-features=false         Exit with status code 5 when no features are found for a particular image

 
아래 표에 정리 하였으며 실습을 통해 자연스럽게 알아보자!

옵션	내용
--whitelist(w)	화이트리스트 파일 (제외할 CVE 코드 정의시 해당 취약점은 제외하고 탐색)
--threshold(t)	원하는 심각도 해당 하는 데이터만 출력 ('Defcon1', 'Critical', 'High', 'Medium', 'Low', 'Negligible', 'Unknown')
--clair(c)	Clair URL
--ip	스캐너가 실행되고 있는 서버 IP
--log(l)	실행 로그 파일
--all, --reportAll	전체 취약점 출력 (default : true)
--report(r)	취약점 결과 로그 파일 (JSON)
--exit-when-no-features	기능이 안되면 오류코드5로 종료한다는 의미 (default : false) 사실 이게 무슨 기능인지 이해하지못했다..문서도 잘 없는것으로 보아 잘 사용하지 않는 옵션인것으로 보인다.

이제 예시로 많이 사용하는 두개의 이미지를 가져오며 해당 이미지가 취약점에 노출 되어 있는지 확인해보자!
jdk11, aws-cli 이미지를 가져오면 아래와 같이 이미지 리스트 확인 가능하다.

$ docker pull gradle:jdk11
$ docker pull bitnami/aws-cli:latest
$ docker images
REPOSITORY                TAG       IMAGE ID       CREATED          SIZE
bitnami/aws-cli           latest    8857f7a322a2   37 minutes ago   380MB
arminc/clair-db           latest    25b8ede57145   21 hours ago     662MB
arminc/clair-local-scan   latest    88a4a04f3017   21 hours ago     64.3MB
gradle                    jdk11     f22d6e8c55ec   5 days ago       743MB

이제 취약점을 스캔해보자! 
먼저 gradle jdk 부터 검사해본다.

$ clair-scanner --ip ${IP} --clair=http://localhost:6060 --log="clair.log" --report="gradle_report.txt" gradle:jdk11

만약 실습 하다가 'no space left on device' 오류가 뜬다면 디스크 공간이 없는것으로 [EC2 볼륨 확장] 글을 참고한다.

2023/03/21 22:10:56 [INFO] ▶ Start clair-scanner
2023/03/21 22:11:07 [CRIT] ▶ Could not save Docker image [gradle:jdk11]: Error response from daemon: write /var/lib/docker/tmp/docker-export-.../.../layer.tar: no space left on device

아래와 같이 나오는것을 볼 수 있으며 결과 로그에도 동일하게 남아있다. 

$ cat clair.log
2023/03/21 22:33:37 [INFO] ▶ Start clair-scanner
2023/03/21 22:33:45 [INFO] ▶ Server listening on port 9279
2023/03/21 22:33:45 [INFO] ▶ Analyzing ..
2023/03/21 22:33:48 [INFO] ▶ Analyzing ......
2023/03/21 22:33:48 [INFO] ▶ Analyzing ...
2023/03/21 22:33:48 [INFO] ▶ Analyzing ..
2023/03/21 22:33:48 [INFO] ▶ Analyzing ..
2023/03/21 22:33:48 [INFO] ▶ Analyzing ...
2023/03/21 22:33:49 [INFO] ▶ Analyzing ..
2023/03/21 22:33:49 [INFO] ▶ Image [gradle:jdk11] contains NO unapproved vulnerabilities

분석이 7번 으로 나누어 처리된것을 볼 수 있는데 이는 레이어가 7개로 구성된 이미지이기 때문이다.

$ docker image inspect [Image ID]
.. 
 "Type": "layers",
            "Layers": [
                "sha256:..",
                "sha256:..",
                "sha256:..",
                "sha256:..",
                "sha256:..",
                "sha256:..",
                "sha256:.."
            ]

승인되지 않은 취약점이 없기에 아래와 같이 결과 리포트도 비어있다.

$ cat gradle_report.txt
{
    "image": "gradle:jdk11",
    "unapproved": [],
    "vulnerabilities": []

이제 aws-cli를 검사해보자!
이번에는 45개의 승인되지 않은 취약점이 발견 되었다.

$ clair-scanner --ip 172.x.x.x --clair=http://localhost:6060 --log="clair.log" --report="aws-cli_report.txt" bitnami/aws-cli:latest
2023/03/21 22:42:03 [INFO] ▶ Server listening on port 9279
2023/03/21 22:42:03 [INFO] ▶ Analyzing bd878fcb7477651a5b8710ed307e6fd78a9144f5f6827473815321dfcf8ff8a3
2023/03/21 22:42:04 [WARN] ▶ Image [bitnami/aws-cli:latest] contains 45 total vulnerabilities
2023/03/21 22:42:04 [ERRO] ▶ Image [bitnami/aws-cli:latest] contains 45 unapproved vulnerabilities
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| STATUS     | CVE SEVERITY                | PACKAGE NAME | PACKAGE VERSION  | CVE DESCRIPTION                                              |
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| Unapproved | High CVE-2019-8457          | db5.3        | 5.3.28+dfsg1-0.8 | SQLite3 from 3.6.0 to and including 3.27.2 is                |
|            |                             |              |                  | vulnerable to heap out-of-bound read in the rtreenode()      |
|            |                             |              |                  | function when handling invalid rtree tables.                 |
|            |                             |              |                  | https://security-tracker.debian.org/tracker/CVE-2019-8457    |
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| Unapproved | Medium CVE-2022-29458       | ncurses      | 6.2+20201114-2   | ncurses 6.3 before patch 20220416 has an out-of-bounds       |
|            |                             |              |                  | read and segmentation violation in convert_strings           |
|            |                             |              |                  | in tinfo/read_entry.c in the terminfo library.               |
|            |                             |              |                  | https://security-tracker.debian.org/tracker/CVE-2022-29458   |
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| Unapproved | Medium CVE-2022-1304        | e2fsprogs    | 1.46.2-2         | An out-of-bounds read/write vulnerability was                |
|            |                             |              |                  | found in e2fsprogs 1.46.5. This issue leads to               |
|            |                             |              |                  | a segmentation fault and possibly arbitrary code             |
|            |                             |              |                  | execution via a specially crafted filesystem.                |
|            |                             |              |                  | https://security-tracker.debian.org/tracker/CVE-2022-1304    |
....
...
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| Unapproved | Unknown CVE-2022-3715       | bash         | 5.1-2+deb11u1    | A flaw was found in the bash package, where a heap-buffer    |
|            |                             |              |                  | overflow can occur in valid parameter_transform.             |
|            |                             |              |                  | This issue may lead to memory problems.                      |
|            |                             |              |                  | https://security-tracker.debian.org/tracker/CVE-2022-3715    |
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| Unapproved | Unknown CVE-2022-3821       | systemd      | 247.3-7+deb11u1  | An off-by-one Error issue was discovered in Systemd          |
|            |                             |              |                  | in format_timespan() function of time-util.c. An             |
|            |                             |              |                  | attacker could supply specific values for time               |
|            |                             |              |                  | and accuracy that leads to buffer overrun in                 |
|            |                             |              |                  | format_timespan(), leading to a Denial of Service.           |
|            |                             |              |                  | https://security-tracker.debian.org/tracker/CVE-2022-3821    |
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| Unapproved | Unknown CVE-2022-4415       | systemd      | 247.3-7+deb11u1  | A vulnerability was found in systemd. This security flaw     |
|            |                             |              |                  | can cause a local information leak due to systemd-coredump   |
|            |                             |              |                  | not respecting the fs.suid_dumpable kernel setting.          |
|            |                             |              |                  | https://security-tracker.debian.org/tracker/CVE-2022-4415    |
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+

결과 리포트파일 확인해보면 Json 형태로 결과를 확인 할 수 있다.

$ cat aws-cli_report.txt
{
    "image": "bitnami/aws-cli:latest",
    "unapproved": [
        "CVE-2020-13529",
        "CVE-2022-4415",
        "CVE-2022-3821",
        "CVE-2013-4392",
       ....
        "CVE-2018-20796",
        "CVE-2019-1010023",
        "CVE-2019-1010024",
        "CVE-2019-1010025",
        "CVE-2011-3389"
    ],
    "vulnerabilities": [
        {
            "featurename": "db5.3",
            "featureversion": "5.3.28+dfsg1-0.8",
            "vulnerability": "CVE-2019-8457",
            "namespace": "debian:11",
            "description": "SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.",
            "link": "https://security-tracker.debian.org/tracker/CVE-2019-8457",
            "severity": "High",
            "fixedby": ""
        },
        {
            "featurename": "ncurses",
            "featureversion": "6.2+20201114-2",
            "vulnerability": "CVE-2022-29458",
            "namespace": "debian:11",
            "description": "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
            "link": "https://security-tracker.debian.org/tracker/CVE-2022-29458",
            "severity": "Medium",
            "fixedby": ""
        },..

 
여기서 조치가 필요 없다고 생각하는 코드 예시로 Unknown 레벨 세개를 아래와 같이 화이트리스트 파일을 만들어 제외 시키도록 해보자!
// whitelist.yaml

generalwhitelist: # 이미지 모두 대상으로 제외하고 싶은 취약점 정의
  CVE-2022-3715: bash # [취약점코드]: [report 파일의 featurename or 콘솔 로그의 packname] 
  CVE-2022-4415: systemd
images:
  bitnami/aws-cli: # 특정 이미지에서만 취약점 제외하고 싶을때 이미지명 정의하고 취약점 정의
    CVE-2022-3821: systemd

이제 취약점 진단을 다시 해보면 Approved 라고 뜨며 승인 된 코드로 변경 되었다!

$ clair-scanner --ip 172.24.22.170 --clair=http://localhost:6060 --log="clair.log" --report="aws-cli_report.txt" --whitelist=whitelist.yaml bitnami/aws-cli:latest
...
..
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| Unapproved | Negligible CVE-2022-3219    | gnupg2       | 2.2.27-2+deb11u2 | GnuPG can be made to spin on a relatively small input        |
|            |                             |              |                  | by (for example) crafting a public key with thousands of     |
|            |                             |              |                  | signatures attached, compressed down to just a few KB.       |
|            |                             |              |                  | https://security-tracker.debian.org/tracker/CVE-2022-3219    |
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| Approved   | Unknown CVE-2022-3821       | systemd      | 247.3-7+deb11u1  | An off-by-one Error issue was discovered in Systemd          |
|            |                             |              |                  | in format_timespan() function of time-util.c. An             |
|            |                             |              |                  | attacker could supply specific values for time               |
|            |                             |              |                  | and accuracy that leads to buffer overrun in                 |
|            |                             |              |                  | format_timespan(), leading to a Denial of Service.           |
|            |                             |              |                  | https://security-tracker.debian.org/tracker/CVE-2022-3821    |
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| Approved   | Unknown CVE-2022-4415       | systemd      | 247.3-7+deb11u1  | A vulnerability was found in systemd. This security flaw     |
|            |                             |              |                  | can cause a local information leak due to systemd-coredump   |
|            |                             |              |                  | not respecting the fs.suid_dumpable kernel setting.          |
|            |                             |              |                  | https://security-tracker.debian.org/tracker/CVE-2022-4415    |
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+
| Approved   | Unknown CVE-2022-3715       | bash         | 5.1-2+deb11u1    | A flaw was found in the bash package, where a heap-buffer    |
|            |                             |              |                  | overflow can occur in valid parameter_transform.             |
|            |                             |              |                  | This issue may lead to memory problems.                      |
|            |                             |              |                  | https://security-tracker.debian.org/tracker/CVE-2022-3715    |
+------------+-----------------------------+--------------+------------------+--------------------------------------------------------------+

해당 화이트리스트를 제외하도록 옵션을 주고 다시 실행하면 해당 코드는 제외하고 탐색된것을 볼 수 있다.
결과 리포트에서도 승인된 취약점이기에 unapproved(승인되지않음) 리스트에서 제외 되었으며 취약점 항목인 vulnerabilities에는 나오는것을 볼 수 있다. 

$ cat aws-cli_report.txt
{
    "image": "bitnami/aws-cli:latest",
    "unapproved": [
        "CVE-2022-48303",
        "CVE-2005-2541",
        "CVE-2017-18018",
        "CVE-2016-2781",
        ..
     "vulnerabilities": [
        {
            "featurename": "systemd",
            "featureversion": "247.3-7+deb11u1",
            "vulnerability": "CVE-2022-4415",
            "namespace": "debian:11",
            "description": "A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.",
            "link": "https://security-tracker.debian.org/tracker/CVE-2022-4415",
            "severity": "Unknown",
            "fixedby": ""
        },
        {
            "featurename": "systemd",
            "featureversion": "247.3-7+deb11u1",
            "vulnerability": "CVE-2022-3821",
            "namespace": "debian:11",
            "description": "An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.",
            "link": "https://security-tracker.debian.org/tracker/CVE-2022-3821",
            "severity": "Unknown",
            "fixedby": ""
        }

 
끝!!