CVE-2019-5736: runc container breakout

#1

Post by afshinmeh » Mon, Feb 11, 2019, 4:38 PM UTC

CVE-2019-5736: runc container breakout
seclists.org

Re: CVE-2019-5736: runc container breakout

#2

Post by CaliforniaKarl » Mon, Feb 11, 2019, 5:07 PM UTC

Red Hat’s page on the vulnerability: https://access.redhat.com/security/vulnerabilities/runcescap...

RH CVE page, with the vulnerability’s metrics and the list of RH packages affected (plus links to the errata pages that have details on fixed builds): https://access.redhat.com/security/cve/cve-2019-5736

Re: CVE-2019-5736: runc container breakout

#3

Post by gr2020 » Mon, Feb 11, 2019, 5:11 PM UTC

Looks like Docker 18.09.2 was released a few minutes ago to address this: https://github.com/docker/docker-ce/releases

Re: CVE-2019-5736: runc container breakout

#4

Post by koolba » Mon, Feb 11, 2019, 5:16 PM UTC

Is this issue specific to containers running as root?

Re: CVE-2019-5736: runc container breakout

#5

Post by [deleted] » Mon, Feb 11, 2019, 5:19 PM UTC

[deleted]

Re: CVE-2019-5736: runc container breakout

#6

Post by cyphar » Mon, Feb 11, 2019, 5:19 PM UTC

koolba wrote: post #4

Is this issue specific to containers running as root?

Yes. You need to be able to run a container as root (or rather, as a user which has write access to the host runc binary -- which is usually root). User namespaces protect you for this reason.

Re: CVE-2019-5736: runc container breakout

#7

Post by [deleted] » Mon, Feb 11, 2019, 5:20 PM UTC

[deleted] wrote: post #5

[deleted]

[deleted]

Re: CVE-2019-5736: runc container breakout

#8

Post by CaliforniaKarl » Mon, Feb 11, 2019, 5:20 PM UTC

Debian’s security tracker, showing the affected versions, and (when available) the fixed versions: https://security-tracker.debian.org/tracker/CVE-2019-5736

And Ubuntu’s: https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2...

Personally, I like these vs. RHEL, since all the info is on page.

Re: CVE-2019-5736: runc container breakout

#9

Post by darren0 » Mon, Feb 11, 2019, 5:29 PM UTC

The best fix is to upgrade to 18.09.2. For those that can't do that immediately, backported versions of runc for Docker releases going back to 1.12.6 are available from Rancher at https://github.com/rancher/runc-cve. But please only do that as a temporary workaround until you can properly upgrade to 18.09.2.

Please patch if you don't 100% trust all users on your host.

Re: CVE-2019-5736: runc container breakout

#10

Post by pizlonator » Mon, Feb 11, 2019, 5:33 PM UTC

Yikes that's a big patch! Just on a meta-level, security vulnerabilities fixed with big patches are usually the least fun.

Also, I would bet that freshly written C code has about 1 RCE bug every 100 LoC. This patch has 236 LoCs so probably about 2.36 RCE's.