oss-security - CVE-2019-5736: runc container breakout exploit code

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190213093151.znxnjuqtwbdlwnom@yavin>
Date: Wed, 13 Feb 2019 20:31:51 +1100
From: Aleksa Sarai <cyphar@...har.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2019-5736: runc container breakout exploit code

Someone outside of the embargo has posted a PoC of the exploit for
CVE-2019-5736 (which is related though not using the same vector)[1].
Since the original researchers have posted a blog post explaining the
exploit in some detail[2], I've decided to post the exploit code early
-- since the cat is out of the bag anyway.

CVE-2019-5736.tar.xz has the exploit code and an explanation of how to
use it. Our exploit code uses shared libraries, but you can create a
similar exploit by doing something like (thanks to Darren Shepherd from
Rancher Labs for pointing this out):

1. Run a script with a #!-line of "#!/proc/self/exe events" which will
   run "runc events" (which blocks for long enough).
2. A malicious process then opens /proc/$pid/exe (this is now allowed
   because the non-dumpable bit was cleared on execve).
3. Kill "runc events" and then re-open the exe fd read-write using the
   "/proc/self/fd/..." trick.

This is basically what [1] does -- but it does come with the downside
that you can't craft a malicious image that does this, you need to have
a separate program already running in the container and then attack
"docker exec".

As discussed in the previous mail, this exploit code also impacts LXC
(and several other runtimes have contacted me to say that they are also
vulnerable -- I would suggest that runtimes should ask to join
<security-announce@...ncontainers.org>).

[1]: https://github.com/feexd/pocs/blob/master/CVE-2019-5736/exploit.c
[2]: https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html

-- 
Aleksa Sarai
Senior Software Engineer (Containers)
SUSE Linux GmbH
<https://www.cyphar.com/>

Download attachment "CVE-2019-5736.tar.xz" of type "application/x-xz" (3548 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.