CVE-2019-5736

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. (CVE-2019-5736)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [stream Rocky Linux8] rebase container-selinux to 2.94 (BZ#1693675)

• [stream Rocky Linux8] unable to mount disk at /var/lib/containers via systemd unit when container-selinux policy installed (BZ#1695669)

• [stream Rocky Linux8] don't allow a container to connect to random services (BZ#1695689)

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. (CVE-2019-5736)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [stream rhel8] rebase container-selinux to 2.94 (BZ#1693675)

• [stream rhel8] unable to mount disk at /var/lib/containers via systemd unit when container-selinux policy installed (BZ#1695669)

• [stream rhel8] don't allow a container to connect to random services (BZ#1695689)

Not using pivot_root(2) leaves the host /proc around in the mount namespace so that it is possible to mount another /proc without any other submount, even if /proc in the container is not fully visible. This flaw allows an attacker to read and modify some parts of the Linux kernel memory (rhbz#1663068).

runc through 1.0-rc6 allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: a new container with an attacker-controlled image, or an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe (CVE-2019-5736).

LXC allows attackers to overwrite the host LXC binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: a new container with an attacker-controlled image, or an existing container, to which the attacker previously had write access. This occurs because of file-descriptor mishandling, related to /proc/self/exe. This attack is only possible with privileged containers since it requires root privilege on the host to overwrite the binary.

This update for runc fixes the following issues:

Security vulnerabilities addressed:

• CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967)
• CVE-2018-16873: Fix a remote command execution during 'go get -u' (boo#1118897)
• CVE-2018-16874: Fix a directory traversal in 'go get' via curly braces in import paths (boo#1118898)
• CVE-2018-16875: Fix a CPU denial of service issue (boo#1118899)

Other changes and bug fixes:

• Update go requirements to >= go1.10
• Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah.
• Make use of %license macro
• Remove 'go test' from %check section, as it has only ever caused us problems and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke testing has been far more useful. (boo#1095817)
• Upgrade to runc v1.0.0~rc6. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6

This update for runc fixes the following issues:

Security vulnerablities addressed:

• CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967)
• CVE-2018-16873: Fix a remote command execution during 'go get -u' (boo#1118897)
• CVE-2018-16874: Fix a directory traversal in 'go get' via curly braces in import paths (boo#1118898)
• CVE-2018-16875: Fix a CPU denial of service issue (boo#1118899)

Other changes and bug fixes:

• Update go requirements to >= go1.10
• Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah.
• Make use of %license macro
• Remove 'go test' from %check section, as it has only ever caused us problems and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke testing has been far more useful. (boo#1095817)
• Upgrade to runc v1.0.0~rc6. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6

This update for docker-runc fixes the following issues:

Security issue fixed:

• CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967)

This update was imported from the SUSE:SLE-15:Update update project.

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues:

Security issues fixed:

• CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899).
• CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898).
• CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897).
• CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967).

Other changes and fixes:

• Update shell completion to use Group: System/Shells.
• Add daemon.json file with rotation logs configuration (bsc#1114832)
• Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.
• Update go requirements to >= go1.10
• Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429).
• Remove the usage of 'cp -r' to reduce noise in the build logs.

This update was imported from the SUSE:SLE-15:Update update project.

This update for lxc, lxcfs to version 3.1.0 fixes the following issues:

Security issues fixed:

• CVE-2019-5736: Fixed a container breakout vulnerability (boo#1122185).
• CVE-2018-6556: Enable setuid bit on lxc-user-nic (boo#988348).

Non-security issues fixed:

• Update to LXC 3.1.0. The changelog is far too long to include here, please look at https://linuxcontainers.org/. (boo#1131762)

This update for lxc, lxcfs to version 3.1.0 fixes the following issues:

Security issues fixed:

• CVE-2019-5736: Fixed a container breakout vulnerability (boo#1122185).
• CVE-2018-6556: Enable setuid bit on lxc-user-nic (boo#988348).

Non-security issues fixed:

• Update to LXC 3.1.0. The changelog is far too long to include here, please look at https://linuxcontainers.org/. (boo#1131762)

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:

Security issues fixed:

• CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).
• CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).
• CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).
• CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).
• CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).

Other changes and bug fixes:

• Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).
• Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).
• Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).
• docker-test: Improvements to test packaging (bsc#1128746).
• Move daemon.json file to /etc/docker directory (bsc#1114832).
• Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209).
• Fix go build failures (bsc#1121397).

This update was imported from the SUSE:SLE-15:Update update project.

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:

Security issues fixed:

• CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).
• CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).
• CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).
• CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).
• CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).

Other changes and bug fixes:

• Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).
• Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).
• Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).
• docker-test: Improvements to test packaging (bsc#1128746).
• Move daemon.json file to /etc/docker directory (bsc#1114832).
• Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209).
• Fix go build failures (bsc#1121397).

This update was imported from the SUSE:SLE-15:Update update project.

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:

Security issues fixed:

• CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).
• CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).
• CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).
• CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).
• CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).

Other changes and bug fixes:

• Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).
• Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).
• Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).
• docker-test: Improvements to test packaging (bsc#1128746).
• Move daemon.json file to /etc/docker directory (bsc#1114832).
• Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209).
• Fix go build failures (bsc#1121397).

This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project.

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:

Docker:

• CVE-2019-14271: Fixed a code injection if the nsswitch facility dynamically loaded a library inside a chroot (bsc#1143409).
• CVE-2019-13509: Fixed an information leak in the debug log (bsc#1142160).
• Update to version 19.03.1-ce, see changelog at /usr/share/doc/packages/docker/CHANGELOG.md (bsc#1142413, bsc#1139649).

runc:

• Use %config(noreplace) for /etc/docker/daemon.json (bsc#1138920).
• Update to runc 425e105d5a03, which is required by Docker (bsc#1139649).

containerd:

• CVE-2019-5736: Fixed a container breakout vulnerability (bsc#1121967).
• Update to containerd v1.2.6, which is required by docker (bsc#1139649).

golang-github-docker-libnetwork:

• Update to version git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is required by docker (bsc#1142413, bsc#1139649).

This update was imported from the SUSE:SLE-15:Update update project.

This update for lxc fixes the following issues:

Update to lxc 3.2.1. The changelog can be found at

https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322

• seccomp: support syscall forwarding to userspace
• add lxc.seccomp.allow_nesting
• pidfd: Add initial support for the new pidfd api

• Many hardening improvements.
• Use /sys/kernel/cgroup/delegate file for cgroup v2.
• Fix CVE-2019-5736 equivalent bug.

• fix apparmor dropin to be compatible with LXC 3.1.0 (boo#1131762)

This update for lxc fixes the following issues:

Update to lxc 3.2.1. The changelog can be found at

https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322

• seccomp: support syscall forwarding to userspace
• add lxc.seccomp.allow_nesting
• pidfd: Add initial support for the new pidfd api

• Many hardening improvements.
• Use /sys/kernel/cgroup/delegate file for cgroup v2.
• Fix CVE-2019-5736 equivalent bug.

• fix apparmor dropin to be compatible with LXC 3.1.0 (boo#1131762) This update was imported from the openSUSE:Leap:15.1:Update update project.

These are all security issues fixed in the containerd-1.4.8-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the flatpak-1.11.3-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the liblxc-devel-4.0.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the runc-1.0.2-1.2 package on the GA media of openSUSE Tumbleweed.

This update for docker-runc fixes the following issues:

Security issue fixed:

• CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967)

This update for docker-runc fixes the following issues:

Security issue fixed:

• CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues:

Security issues fixed:

• CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899).
• CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898).
• CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897).
• CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967).

Other changes and fixes:

• Update shell completion to use Group: System/Shells.
• Add daemon.json file with rotation logs configuration (bsc#1114832)
• Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.
• Update go requirements to >= go1.10
• Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429).
• Remove the usage of 'cp -r' to reduce noise in the build logs.

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues:

Security issues fixed:

• CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899).
• CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898).
• CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897).
• CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967).

Other changes and bug fixes:

• Update shell completion to use Group: System/Shells.
• Add daemon.json file with rotation logs configuration (bsc#1114832)
• Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.
• Disable leap based builds for kubic flavor (bsc#1121412).
• Allow users to explicitly specify the NIS domain name of a container (bsc#1001161).
• Update docker.service to match upstream and avoid rlimit problems (bsc#1112980).
• Update go requirements to >= go1.10
• Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429).
• Remove the usage of 'cp -r' to reduce noise in the build logs.

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:

Security issues fixed:

• CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).
• CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).
• CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).
• CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).
• CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).

Other changes and bug fixes:

• Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).
• Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).
• Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).
• docker-test: Improvements to test packaging (bsc#1128746).
• Move daemon.json file to /etc/docker directory (bsc#1114832).
• Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209).
• Fix go build failures (bsc#1121397).

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues:

Security issues fixed:

• CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).
• CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).
• CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).
• CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).
• CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).

Other changes and bug fixes:

• Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).
• Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).
• Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).
• docker-test: Improvements to test packaging (bsc#1128746).
• Move daemon.json file to /etc/docker directory (bsc#1114832).
• Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209).
• Fix go build failures (bsc#1121397).

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:

Docker:

• CVE-2019-14271: Fixed a code injection if the nsswitch facility dynamically loaded a library inside a chroot (bsc#1143409).
• CVE-2019-13509: Fixed an information leak in the debug log (bsc#1142160).
• Update to version 19.03.1-ce, see changelog at /usr/share/doc/packages/docker/CHANGELOG.md (bsc#1142413, bsc#1139649).

runc:

• Use %config(noreplace) for /etc/docker/daemon.json (bsc#1138920).
• Update to runc 425e105d5a03, which is required by Docker (bsc#1139649).

containerd:

• CVE-2019-5736: Fixed a container breakout vulnerability (bsc#1121967).
• Update to containerd v1.2.6, which is required by docker (bsc#1139649).

golang-github-docker-libnetwork:

• Update to version git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is required by docker (bsc#1142413, bsc#1139649).

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:

Docker:

• CVE-2019-14271: Fixed a code injection if the nsswitch facility dynamically loaded a library inside a chroot (bsc#1143409).
• CVE-2019-13509: Fixed an information leak in the debug log (bsc#1142160).
• Update to version 19.03.1-ce, see changelog at /usr/share/doc/packages/docker/CHANGELOG.md (bsc#1142413).

golang-github-docker-libnetwork:

• Update to version git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is required by docker (bsc#1142413).

This update for containerd, docker, runc fixes the following issues:

• Docker was updated to 20.10.6-ce

  • Switch version to use -ce suffix rather than _ce to avoid confusing other tools (bsc#1182476).
  • CVE-2021-21284: Fixed a potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732)
  • CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest crashes the dockerd daemon (bsc#1181730).

• runc was updated to v1.0.0~rc93 (bsc#1182451 and bsc#1184962).

  • Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).
  • Fixed /dev/null is not available (bsc#1168481).
  • Fixed an issue where podman hangs when spawned by salt-minion process (bsc#1149954).
  • CVE-2019-19921: Fixed a race condition with shared mounts (bsc#1160452).
  • CVE-2019-16884: Fixed an LSM bypass via malicious Docker image that mount over a /proc directory (bsc#1152308).
  • CVE-2019-5736: Fixed potential write attacks to the host runc binary (bsc#1121967).
  • Fixed an issue where after a kernel-update docker doesn't run (bsc#1131314 bsc#1131553)
  • Ensure that we always include the version information in runc (bsc#1053532).

• Switch to Go 1.13 for build.

  • CVE-2018-16873: Fixed a potential remote code execution (bsc#1118897).
  • CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces in import paths (bsc#1118898).
  • CVE-2018-16875: Fixed a CPU denial of service (bsc#1118899).
  • Fixed an issue with building containers (bsc#1095817).

• containerd was updated to v1.4.4

  • CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).
  • Handle a requirement from docker (bsc#1181594).
  • Install the containerd-shim* binaries and stop creating (bsc#1183024).
  • update version to the one required by docker (bsc#1034053)

• Use -buildmode=pie for tests and binary build (bsc#1048046, bsc#1051429)

• Cleanup seccomp builds similar (bsc#1028638).

• Update to handle the docker-runc removal, and drop the -kubic flavour (bsc#1181677, bsc#1181749)

Aleksa Sarai discovered that Docker was vulnerable to a directory traversal attack. An attacker could use this vulnerability to read and write arbitrary files on the host filesystem as root.