Opencontainers runc CVE-2019-5736 Local Command Execution Vulnerability

Bugtraq ID:	106976
Class:	Design Error
CVE:	CVE-2019-5736
Remote:	No
Local:	Yes
Published:	Feb 11 2019 12:00AM
Updated:	Mar 22 2019 05:00AM
Credit:	Adam Iwaniuk and Borys Poplawski
Vulnerable:	VMWare vSphere Integrated Containers 1.3 VMWare vSphere Integrated Containers 1.2 VMWare vSphere Integrated Containers 1.1 VMWare vSphere Integrated Containers 1.0 VMWare vCloud Director Container Service Extension (CSE) 1.1 VMWare vCloud Director Container Service Extension (CSE) 1.0 VMWare PKS 1.3.1 VMWare PKS 1.3 VMWare PKS 1.2.8 VMWare PKS 1.2.7 VMWare PKS 1.2.6 VMWare PKS 1.2.5 VMWare PKS 1.2.4 VMWare PKS 1.2.3 VMWare PKS 1.2.2 VMWare PKS 1.2.1 VMWare PKS 1.2 VMWare Integrated OpenStack with Kubernetes (VIO-K) 5.1 VMWare Integrated OpenStack with Kubernetes (VIO-K) 5.0 Redhat OpenShift Container Platform 3.7 Redhat OpenShift Container Platform 3.6 Redhat OpenShift Container Platform 3.5 Redhat OpenShift Container Platform 3.4 Redhat Enterprise Linux Server 7 Redhat Enterprise Linux for Power, little endian 7 Redhat Enterprise Linux for Power 9 7 Redhat Enterprise Linux for IBM z Systems 7 Redhat Enterprise Linux for IBM System z (Structure A) 7 Redhat Enterprise Linux for ARM 64 7 Redhat Enterprise Linux 7 Pivotal Software Concourse 4.2.2 Pivotal Software Concourse 4.2.1 Opencontainers runc 0.1.1 Opencontainers runc 0.1 Opencontainers runc 0.0.6 Opencontainers runc 1.0-Rc5 Opencontainers runc 1.0-RC1 LXC LXC 0 Kubernetes Kubernetes 1.12.5 Kubernetes Kubernetes 1.12.4 Kubernetes Kubernetes 1.12.3 Kubernetes Kubernetes 1.12.2 Kubernetes Kubernetes 1.12.1 Kubernetes Kubernetes 1.12 Kubernetes Kubernetes 1.11.7 Kubernetes Kubernetes 1.11.6 Kubernetes Kubernetes 1.11.5 Kubernetes Kubernetes 1.11.4 Kubernetes Kubernetes 1.11.3 Kubernetes Kubernetes 1.11.2 Kubernetes Kubernetes 1.11.1 Kubernetes Kubernetes 1.11 Kubernetes Kubernetes 1.10.12 Kubernetes Kubernetes 1.10.11 Kubernetes Kubernetes 1.10.10 Kubernetes Kubernetes 1.10.9 Kubernetes Kubernetes 1.10.8 Kubernetes Kubernetes 1.10.7 Kubernetes Kubernetes 1.10.6 Kubernetes Kubernetes 1.10.5 Kubernetes Kubernetes 1.10.4 Kubernetes Kubernetes 1.10.3 Kubernetes Kubernetes 1.10.2 Kubernetes Kubernetes 1.10.1 Kubernetes Kubernetes 1.10 Kubernetes Kubernetes 1.9.10 Kubernetes Kubernetes 1.9.9 Kubernetes Kubernetes 1.9.8 Kubernetes Kubernetes 1.9.7 Kubernetes Kubernetes 1.9.6 Kubernetes Kubernetes 1.9.5 Kubernetes Kubernetes 1.9.4 Kubernetes Kubernetes 1.9.3 Kubernetes Kubernetes 1.9.2 Kubernetes Kubernetes 1.9.1 Kubernetes Kubernetes 1.9 Kubernetes Kubernetes 1.8 Kubernetes Kubernetes 1.7.7 Kubernetes Kubernetes 1.7.6 Kubernetes Kubernetes 1.7 Kubernetes Kubernetes 1.6.11 Kubernetes Kubernetes 1.6.10 Kubernetes Kubernetes 1.6 Kubernetes Kubernetes 1.5.8 Kubernetes Kubernetes 1.5.7 Kubernetes Kubernetes 1.5 Kubernetes Kubernetes 1.2 Kubernetes Kubernetes 1.0 Docker Docker 18.9.1 Docker Docker 1.12.6 Docker Docker 1.12 Docker Docker 1.6.1 Docker Docker 1.6 Docker Docker 1.3.3 Docker Docker 18.09 Docker Docker 18.06 Docker Docker 17.05 Docker Docker 17.04 Docker Docker 17.03 Docker Docker 1.8.3 Docker Docker 1.4.1 Docker Docker 1.3.2 Docker Docker 1.3.1 Docker Docker 1.3.0 Docker Docker 1.12.3 Docker Docker 1.12.2 Docker Docker 1.0.0 Cisco Defense Orchestrator 19.3(0) Cisco Container Platform 0 Amazon Web Services AWS IoT GreenGrass 1.7.1 Amazon Web Services AWS IoT GreenGrass 1.6.1 Amazon Web Services AWS Fargate Platform 1.3 Amazon Web Services AWS Fargate Platform 1.2 Amazon Web Services AWS Fargate Platform 1.1 Amazon Web Services AWS Fargate Platform 1.0 Amazon Web Services AWS Cloud9 0 Amazon Web Services Amazon Linux AMI 2018.03 Amazon Web Services Amazon Linux 2
Not Vulnerable:	VMWare vCloud Director Container Service Extension (CSE) 1.2.7 VMWare PKS 1.3.2 VMWare PKS 1.2.9 Opencontainers runc 1.0-Rc6 Kubernetes Kubernetes 1.12.5-gke.5 Kubernetes Kubernetes 1.11.7-gke.4 Kubernetes Kubernetes 1.11.6-gke.11 Kubernetes Kubernetes 1.10.12-gke.7 Docker Docker 18.9.2

Opencontainers runc CVE-2019-5736 Local Command Execution Vulnerability

Opencontainers runc is prone to a local command-execution vulnerability.

A local attacker can exploit this issue to execute arbitrary commands with root privileges.

runc through 1.0-rc6 are vulnerable.

Opencontainers runc CVE-2019-5736 Local Command Execution Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Opencontainers runc CVE-2019-5736 Local Command Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Opencontainers runc CVE-2019-5736 Local Command Execution Vulnerability

References:

• CVE-2019-5736 (runC): rexec callers as memfd (Github)
  
• CVE-2019-5736: Escape from Docker and Kubernetes containers to root on host (Dragonsector)
  
• merge branch 'cve-2019-5736' (Opencontainers)
  
• nsenter: clone /proc/self/exe to avoid exposing host binary to container (Opencontainers)
  
• runc Homepage (Opencontainers)
  
• VMSA-2019-0001.1: VMware product updates resolve mishandled file descriptor vul (VMware)
  
• Bug 1664908 CVE-2019-5736 runc: Execution of malicious containers (Redhat)
  
• Container Breakout Vulnerability (CVE-2019-5736) CDO Impact (Cisco)
  
• Container Privilege Escalation Vulnerability Affecting Cisco Products: February (Cisco)
  
• Container Security Issue (CVE-2019-5736) (Amazon Web Services)
  
• CVE-2019-5736 (Redhat)
  
• CVE-2019-5736 and runC vulnerability in AKS (Microsoft)
  
• CVE-2019-5736 Opencontainers-runc Vulnerability in NetApp Products (NetApp)
  
• CVE-2019-5736: runC container breakout (Pivotal)
  
• DOCKER SECURITY UPDATE: CVE-2019-5736 AND CONTAINER SECURITY BEST PRACTICES (Docker)
  
• Frichetten/CVE-2019-5736-PoC (Github)
  
• HPESBHF03913 rev.1 - HPE OneSphere, Container Breakout (HP)
  
• RHSA-2019:0303 - Security Advisory (Redhat)
  
• RHSA-2019:0304 - Security Advisory (Redhat)
  
• RHSA-2019:0401 - Security Advisory (Redhat)
  
• RHSA-2019:0408 - Security Advisory (RE)
  
• Runc and CVE-2019-5736 (Kubernetes)
  
• Security bulletins runc (Google)
  
• Synology-SA-19:06 Docker (Synology)