[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 13 Feb 2019 01:53:10 -0800
From: EJ Campbell <ejc3@...izonmedia.com>
To: "cyphar@...har.com" <cyphar@...har.com>, oss-security@...ts.openwall.com
Subject: Re: CVE-2019-5736: runc container breakout exploit code
While fixing docker / runc is clearly the right fix, would using chattr -i
on runc be a quick mitigation for the issue? I believe that will prevent
the file from being overwritten by the exploit and Etienne Stalmans
verified that it helped:
https://twitter.com/_staaldraad/status/1095354945073754112
(Note I tried top posting this to mailing list and it didn’t work).
EJ
On Wed, Feb 13, 2019 at 1:32 AM Aleksa Sarai <cyphar@...har.com> wrote:
> Someone outside of the embargo has posted a PoC of the exploit for
> CVE-2019-5736 (which is related though not using the same vector)[1].
> Since the original researchers have posted a blog post explaining the
> exploit in some detail[2], I've decided to post the exploit code early
> -- since the cat is out of the bag anyway.
>
> CVE-2019-5736.tar.xz has the exploit code and an explanation of how to
> use it. Our exploit code uses shared libraries, but you can create a
> similar exploit by doing something like (thanks to Darren Shepherd from
> Rancher Labs for pointing this out):
>
> 1. Run a script with a #!-line of "#!/proc/self/exe events" which will
> run "runc events" (which blocks for long enough).
> 2. A malicious process then opens /proc/$pid/exe (this is now allowed
> because the non-dumpable bit was cleared on execve).
> 3. Kill "runc events" and then re-open the exe fd read-write using the
> "/proc/self/fd/..." trick.
>
> This is basically what [1] does -- but it does come with the downside
> that you can't craft a malicious image that does this, you need to have
> a separate program already running in the container and then attack
> "docker exec".
>
> As discussed in the previous mail, this exploit code also impacts LXC
> (and several other runtimes have contacted me to say that they are also
> vulnerable -- I would suggest that runtimes should ask to join
> <security-announce@...ncontainers.org>).
>
> [1]: https://github.com/feexd/pocs/blob/master/CVE-2019-5736/exploit.c
> [2]:
> https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html
>
> --
> Aleksa Sarai
> Senior Software Engineer (Containers)
> SUSE Linux GmbH
> <https://www.cyphar.com/>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
