CVE-2019-19921

runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)

runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)

Impact

By crafting a malicious root filesystem (with /proc being a symlink to a directory which was inside a volume shared with another running container), an attacker in control of both containers can trick runc into not correctly configuring the container's security labels and not correctly masking paths inside /proc which contain potentially-sensitive information about the host (or even allow for direct attacks against the host).

In order to exploit this bug, an untrusted user must be able to spawn custom containers with custom mount configurations (such that a volume is shared between two containers). It should be noted that we consider this to be a fairly high level of access for an untrusted user -- and we do not recommend allowing completely untrusted users to have such degrees of access without further restrictions.

Specific Go Package Affected

github.com/opencontainers/runc/libcontainer

Patches

This vulnerability has been fixed in 1.0.0-rc10. It should be noted that the current fix is effectively a hot-fix, and there are known ways for it to be worked around (such as making the entire root filesystem a shared volume controlled by another container). We recommend that users review their access policies to ensure that untrusted users do not have such high levels of controls over container mount configuration.

Workarounds

If you are not providing the ability for untrusted users to configure mountpoints for runc (or through a higher-level tool such as docker run -v) then you are not vulnerable to this issue. This exploit requires fairly complicated levels of access (which are available for some public clouds but are not necessarily available for all deployments).

Additionally, it appears as though it is not possible to exploit this vulnerability through Docker (due to the order of mounts Docker generates). However you should not depend on this, as it may be possible to work around this roadblock.

Credits

This vulnerability was discovered by Cure53, as part of a third-party security audit.

For more information

If you have any questions or comments about this advisory:

• Open an issue.
• Email us at [email protected], or [email protected] if you think you've found a security bug.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921)

• containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

• podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921)

• containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

• podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.

Security Fix(es):

• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)
• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)
• runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (CVE-2021-43784)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)
• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• containerd: Supplementary groups are not set up properly (CVE-2023-25173)
• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)
• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.

Updated opencontainers-runc package fixes security vulnerability:

An attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization, by adding a symlink to the rootfs that points to a directory on the volume (CVE-2019-19921).

This update for docker-runc fixes the following issues:

• CVE-2019-19921: Fixed a volume mount race condition with shared mounts (bsc#1160452).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the runc-1.0.2-1.2 package on the GA media of openSUSE Tumbleweed.

This update for docker-runc fixes the following issues:

• CVE-2019-19921: Fixed a volume mount race condition with shared mounts (bsc#1160452).

This update for docker-runc fixes the following issues:

• CVE-2019-19921: Fixed a volume mount race condition with shared mounts (bsc#1160452).

This update for runc fixes the following issues:

runc was updated to v1.0.0~rc10

• CVE-2019-19921: Fixed a mount race condition with shared mounts (bsc#1160452).
• Fixed an issue where podman run hangs when spawned by salt-minion process (bsc#1149954).

This update for containerd, docker, runc fixes the following issues:

• Docker was updated to 20.10.6-ce

  • Switch version to use -ce suffix rather than _ce to avoid confusing other tools (bsc#1182476).
  • CVE-2021-21284: Fixed a potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732)
  • CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest crashes the dockerd daemon (bsc#1181730).

• runc was updated to v1.0.0~rc93 (bsc#1182451 and bsc#1184962).

  • Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).
  • Fixed /dev/null is not available (bsc#1168481).
  • Fixed an issue where podman hangs when spawned by salt-minion process (bsc#1149954).
  • CVE-2019-19921: Fixed a race condition with shared mounts (bsc#1160452).
  • CVE-2019-16884: Fixed an LSM bypass via malicious Docker image that mount over a /proc directory (bsc#1152308).
  • CVE-2019-5736: Fixed potential write attacks to the host runc binary (bsc#1121967).
  • Fixed an issue where after a kernel-update docker doesn't run (bsc#1131314 bsc#1131553)
  • Ensure that we always include the version information in runc (bsc#1053532).

• Switch to Go 1.13 for build.

  • CVE-2018-16873: Fixed a potential remote code execution (bsc#1118897).
  • CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces in import paths (bsc#1118898).
  • CVE-2018-16875: Fixed a CPU denial of service (bsc#1118899).
  • Fixed an issue with building containers (bsc#1095817).

• containerd was updated to v1.4.4

  • CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).
  • Handle a requirement from docker (bsc#1181594).
  • Install the containerd-shim* binaries and stop creating (bsc#1183024).
  • update version to the one required by docker (bsc#1034053)

• Use -buildmode=pie for tests and binary build (bsc#1048046, bsc#1051429)

• Cleanup seccomp builds similar (bsc#1028638).

• Update to handle the docker-runc removal, and drop the -kubic flavour (bsc#1181677, bsc#1181749)

It was discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount over the /proc directory and escalate privileges. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-16884)

It was discovered that runC incorrectly performed access control. An attacker could possibly use this issue to escalate privileges. (CVE-2019-19921)

USN-6088-1 fixed vulnerabilities in runC. This update provides the corresponding updates for Ubuntu 16.04 LTS.

It was discovered that runC incorrectly performed access control when mounting /proc to non-directories. An attacker could possibly use this issue to escalate privileges. (CVE-2019-19921)

Felix Wilhelm discovered that runC incorrecly handled netlink messages. An attacker could possibly use this issue to escalate privileges. (CVE-2021-43784)

Andrew G. Morgan discovered that runC incorrectly set inherited process capabilities inside the container. An attacker could possibly use this issue to escalate privileges. (CVE-2022-29162)

Original advisory details:

It was discovered that runC incorrectly made /sys/fs/cgroup writable when in rootless mode. An attacker could possibly use this issue to escalate privileges. (CVE-2023-25809)

It was discovered that runC incorrectly performed access control when mounting /proc to non-directories. An attacker could possibly use this issue to escalate privileges. (CVE-2023-27561)

It was discovered that runC incorrectly handled /proc and /sys mounts inside a container. An attacker could possibly use this issue to bypass AppArmor, and potentially SELinux. (CVE-2023-28642)