[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190213095648.ibfskgddfa4zgdlo@yavin>
Date: Wed, 13 Feb 2019 20:56:48 +1100
From: Aleksa Sarai <cyphar@...har.com>
To: EJ Campbell <ejc3@...izonmedia.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-2019-5736: runc container breakout exploit
code
On 2019-02-13, EJ Campbell <ejc3@...izonmedia.com> wrote:
> While fixing docker / runc is clearly the right fix, would using chattr -i
> on runc be a quick mitigation for the issue? I believe that will prevent
> the file from being overwritten by the exploit and Etienne Stalmans
> verified that it helped:
> https://twitter.com/_staaldraad/status/1095354945073754112
The privileged user in the container could just un-set the immutable
bit using "/proc/self/fd/..." and then open it for writing. A read-only
filesystem would work much better.
--
Aleksa Sarai
Senior Software Engineer (Containers)
SUSE Linux GmbH
<https://www.cyphar.com/>
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
