[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 13 Feb 2019 02:41:48 -0800
From: EJ Campbell <ejc3@...izonmedia.com>
To: Aleksa Sarai <cyphar@...har.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-2019-5736: runc container breakout exploit code
That should have been +i, sorry. Thank you for your quick response.
EJ
On Wed, Feb 13, 2019 at 1:58 AM Aleksa Sarai <cyphar@...har.com> wrote:
> On 2019-02-13, Aleksa Sarai <cyphar@...har.com> wrote:
> > On 2019-02-13, EJ Campbell <ejc3@...izonmedia.com> wrote:
> > > While fixing docker / runc is clearly the right fix, would using
> chattr -i
> > > on runc be a quick mitigation for the issue? I believe that will
> prevent
> > > the file from being overwritten by the exploit and Etienne Stalmans
> > > verified that it helped:
> > > https://twitter.com/_staaldraad/status/1095354945073754112
> >
> > The privileged user in the container could just un-set the immutable
> > bit using "/proc/self/fd/..." and then open it for writing. A read-only
> > filesystem would work much better.
>
> Sorry, I forgot that CAP_LINUX_IMMUTABLE is dropped by default in
> Docker. Yes that mitigation would also work.
>
> --
> Aleksa Sarai
> Senior Software Engineer (Containers)
> SUSE Linux GmbH
> <https://www.cyphar.com/>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
