Date: Wed, 13 Feb 2019 20:31:51 +1100 From: Aleksa Sarai <cyphar@...har.com> To: oss-security@...ts.openwall.com Subject: CVE-2019-5736: runc container breakout exploit code Someone outside of the embargo has posted a PoC of the exploit for CVE-2019-5736 (which is related though not using the same vector). Since the original researchers have posted a blog post explaining the exploit in some detail, I've decided to post the exploit code early -- since the cat is out of the bag anyway. CVE-2019-5736.tar.xz has the exploit code and an explanation of how to use it. Our exploit code uses shared libraries, but you can create a similar exploit by doing something like (thanks to Darren Shepherd from Rancher Labs for pointing this out): 1. Run a script with a #!-line of "#!/proc/self/exe events" which will run "runc events" (which blocks for long enough). 2. A malicious process then opens /proc/$pid/exe (this is now allowed because the non-dumpable bit was cleared on execve). 3. Kill "runc events" and then re-open the exe fd read-write using the "/proc/self/fd/..." trick. This is basically what  does -- but it does come with the downside that you can't craft a malicious image that does this, you need to have a separate program already running in the container and then attack "docker exec". As discussed in the previous mail, this exploit code also impacts LXC (and several other runtimes have contacted me to say that they are also vulnerable -- I would suggest that runtimes should ask to join <security-announce@...ncontainers.org>). : https://github.com/feexd/pocs/blob/master/CVE-2019-5736/exploit.c : https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html -- Aleksa Sarai Senior Software Engineer (Containers) SUSE Linux GmbH <https://www.cyphar.com/> Download attachment "CVE-2019-5736.tar.xz" of type "application/x-xz" (3548 bytes) Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.