oss-sec mailing list archives
CVE-2019-5736: runc container breakout exploit code
From: Aleksa Sarai <cyphar () cyphar com>
Date: Wed, 13 Feb 2019 20:31:51 +1100
Someone outside of the embargo has posted a PoC of the exploit for CVE-2019-5736 (which is related though not using the same vector)[1]. Since the original researchers have posted a blog post explaining the exploit in some detail[2], I've decided to post the exploit code early -- since the cat is out of the bag anyway. CVE-2019-5736.tar.xz has the exploit code and an explanation of how to use it. Our exploit code uses shared libraries, but you can create a similar exploit by doing something like (thanks to Darren Shepherd from Rancher Labs for pointing this out): 1. Run a script with a #!-line of "#!/proc/self/exe events" which will run "runc events" (which blocks for long enough). 2. A malicious process then opens /proc/$pid/exe (this is now allowed because the non-dumpable bit was cleared on execve). 3. Kill "runc events" and then re-open the exe fd read-write using the "/proc/self/fd/..." trick. This is basically what [1] does -- but it does come with the downside that you can't craft a malicious image that does this, you need to have a separate program already running in the container and then attack "docker exec". As discussed in the previous mail, this exploit code also impacts LXC (and several other runtimes have contacted me to say that they are also vulnerable -- I would suggest that runtimes should ask to join <security-announce () opencontainers org>). [1]: https://github.com/feexd/pocs/blob/master/CVE-2019-5736/exploit.c [2]: https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html -- Aleksa Sarai Senior Software Engineer (Containers) SUSE Linux GmbH <https://www.cyphar.com/>
Attachment:
CVE-2019-5736.tar.xz
Description:
Attachment:
signature.asc
Description:
Current thread:
- CVE-2019-5736: runc container breakout exploit code Aleksa Sarai (Feb 13)
- Re: CVE-2019-5736: runc container breakout exploit code EJ Campbell (Feb 13)
- Re: CVE-2019-5736: runc container breakout exploit code Aleksa Sarai (Feb 13)
- Re: CVE-2019-5736: runc container breakout exploit code Aleksa Sarai (Feb 13)
- Re: CVE-2019-5736: runc container breakout exploit code EJ Campbell (Feb 13)
- Re: CVE-2019-5736: runc container breakout exploit code Aleksa Sarai (Feb 13)
- Re: CVE-2019-5736: runc container breakout exploit code EJ Campbell (Feb 13)