Microsoft patched its Windows Host Compute Service Shim library to remove a critical remote code execution vulnerability.
Windows Host Compute Service (HCS) is a low-level container management API for Microsoft’s Hyper-V hypervisor. Microsoft now has two open source wrappers that allow users to call the HCS from higher level programming languages instead of the C API directly.
One of these wrappers is the Windows Host Compute Service Shim (Hcsshim), which supports launching Windows Server containers from the Go language.
The problem is hcsshim does not properly validate input when importing a container image, allowing an attacker to remotely execute arbitrary code on the host operating system.
“To exploit the vulnerability, an attacker would place malicious code in a specially crafted container image which, if an authenticated administrator imported (pulled), could cause a container management service utilizing the Host Compute Service Shim library to execute malicious code on the Windows host,” Microsoft said in a post.
The critical vulnerability has case number of CVE-2018-8115. Microsoft believes it is unlikely to be exploited for malicious purposes.
The flaw has been fixed with the release of hcsshim 0.6.10, which is available on GitHub.