[HIGH] Docker Bench Container Runs with Elevated Privileges

[MacJediWizard]

Description

The Docker Bench scanner runs a container with extremely elevated privileges including `--net host`, `--pid host`, `--userns host`, and mounts of sensitive system directories. While necessary for security scanning, this creates a significant attack surface if the container image is compromised.

Location

`internal/integrations/compliance/docker_bench.go` lines 82-97

args := []string{
    "run", "--rm",
    "--net", "host",
    "--pid", "host",
    "--userns", "host",
    "--cap-add", "audit_control",
    "-v", "/etc:/etc:ro",
    "-v", "/lib/systemd/system:/lib/systemd/system:ro",
    "-v", "/usr/bin/containerd:/usr/bin/containerd:ro",
    "-v", "/usr/bin/runc:/usr/bin/runc:ro",
    "-v", "/usr/lib/systemd:/usr/lib/systemd:ro",
    "-v", "/var/lib:/var/lib:ro",
    "-v", "/var/run/docker.sock:/var/run/docker.sock:ro",
    "--label", "docker_bench_security",
    dockerBenchImage,
}

Impact

• If the Docker Bench image is compromised or replaced, attacker gains host-level access
• Image pulls from `docker/docker-bench-security` could be intercepted
• Container has full visibility into host processes, network, and file system

Recommended Fix

1. Pin Docker Bench to a specific image digest rather than using `latest`:

const dockerBenchImage = "docker/docker-bench-security@sha256:abc123..."

2. Verify image digest before running:

// Before running, verify image digest
verifyCmd := exec.CommandContext(ctx, dockerBinary, "inspect", "--format", "{{.Id}}", dockerBenchImage)
output, err := verifyCmd.Output()
if !strings.HasPrefix(string(output), "sha256:expected...") {
    return nil, fmt.Errorf("docker bench image verification failed")
}

3. Consider adding image signature verification using Docker Content Trust
4. Document the security implications in deployment documentation

Severity

🟠 HIGH - Host compromise risk

Labels

security, high

[MacJediWizard]

Fixed: Docker Bench image is now pinned to a specific digest with verification.

Changes made:

1. Pinned image to specific digest: Changed from docker/docker-bench-security (mutable tag) to docker/docker-bench-security@sha256:ddbdf4f86af4405727e4e81f85a68eb7a934ffe9418553ef2f4c8b301f2c8d3e (immutable digest)

2. Added image verification: Before running, the scanner now verifies the image digest matches the expected value. If verification fails, the scan is aborted with a clear error message.

3. Added documentation: Inline comments explain how to safely update the digest when a new version is needed.

Code changes in docker_bench.go:

const (
    // SECURITY: Pin Docker Bench image to a specific digest to prevent supply chain attacks.
    dockerBenchImageBase   = "docker/docker-bench-security"
    dockerBenchImageDigest = "sha256:ddbdf4f86af4405727e4e81f85a68eb7a934ffe9418553ef2f4c8b301f2c8d3e"
    dockerBenchImage       = dockerBenchImageBase + "@" + dockerBenchImageDigest
)

// In RunScan(): Added verification before running the container
if existingDigest != dockerBenchImageDigest {
    return nil, fmt.Errorf("docker Bench image digest mismatch: expected %s, got %s", dockerBenchImageDigest, existingDigest)
}

Security improvements:

• Supply chain attacks via tag manipulation are now prevented
• Image integrity is verified before running with elevated privileges
• Clear update process documented for maintainers