CVE-2019-5736: runc container breakout exploit code

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
CVE-2019-5736: runc container breakout exploit code

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Aleksa Sarai &lt;cyphar () cyphar com&gt;

Date: Wed, 13 Feb 2019 20:31:51 +1100

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Someone outside of the embargo has posted a PoC of the exploit for
CVE-2019-5736 (which is related though not using the same vector)[1].
Since the original researchers have posted a blog post explaining the
exploit in some detail[2], I've decided to post the exploit code early
-- since the cat is out of the bag anyway.

CVE-2019-5736.tar.xz has the exploit code and an explanation of how to
use it. Our exploit code uses shared libraries, but you can create a
similar exploit by doing something like (thanks to Darren Shepherd from
Rancher Labs for pointing this out):

1. Run a script with a #!-line of "#!/proc/self/exe events" which will
   run "runc events" (which blocks for long enough).
2. A malicious process then opens /proc/$pid/exe (this is now allowed
   because the non-dumpable bit was cleared on execve).
3. Kill "runc events" and then re-open the exe fd read-write using the
   "/proc/self/fd/..." trick.

This is basically what [1] does -- but it does come with the downside
that you can't craft a malicious image that does this, you need to have
a separate program already running in the container and then attack
"docker exec".

As discussed in the previous mail, this exploit code also impacts LXC
(and several other runtimes have contacted me to say that they are also
vulnerable -- I would suggest that runtimes should ask to join
&lt;security-announce () opencontainers org&gt;).

[1]: https://github.com/feexd/pocs/blob/master/CVE-2019-5736/exploit.c
[2]: https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html

-- 
Aleksa Sarai
Senior Software Engineer (Containers)
SUSE Linux GmbH
&lt;https://www.cyphar.com/&gt;
Attachment:
CVE-2019-5736.tar.xz
Description: 
Attachment:
signature.asc
Description: 

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2019-5736: runc container breakout exploit code Aleksa Sarai (Feb 13)

Re: CVE-2019-5736: runc container breakout exploit code EJ Campbell (Feb 13)

Re: CVE-2019-5736: runc container breakout exploit code Aleksa Sarai (Feb 13)

Re: CVE-2019-5736: runc container breakout exploit code Aleksa Sarai (Feb 13)
Re: CVE-2019-5736: runc container breakout exploit code EJ Campbell (Feb 13)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->