40 lines
1.7 KiB
Markdown
40 lines
1.7 KiB
Markdown
# CVE-2019-16884: runc AppArmor confinement weakened by incorrect mount-target validation for /proc
|
|
|
|
**Scope:** [audit](../README.md) · [README](../../README.md) · [COMPARISON](../../COMPARISON.md) · [docs/RESEARCH](../../docs/RESEARCH.md)
|
|
|
|
CVSS 6.5-7.5. Fixed in runc 1.0.0-rc9.
|
|
|
|
## Source
|
|
|
|
- [Rapid7 vulnerability record](https://www.rapid7.com/db/vulnerabilities/redhat-openshift-cve-2019-16884)
|
|
- [Debian security tracker](https://security-tracker.debian.org/tracker/CVE-2019-16884)
|
|
|
|
## Relevance to doos
|
|
|
|
runc's root filesystem setup validated a mount target incorrectly, letting a crafted
|
|
image mount something over `/proc` in a way that weakened the AppArmor profile runc
|
|
otherwise applies. doos has no AppArmor profile that constrains the container's own
|
|
filesystem view the way `docker-default` does (COMPARISON.md section 6 already states
|
|
this as a design difference, not a bug), so the specific confinement this CVE weakens
|
|
does not exist in doos to begin with. What is still worth checking directly is the thing
|
|
runc's bug actually let an attacker do: substitute a non-`proc` mount at the container's
|
|
`/proc`.
|
|
|
|
|
|
## What the check does
|
|
|
|
Attaches a container and checks, from inside, that `/proc`'s filesystem type (via
|
|
`/proc/self/mountinfo` on the real `/proc` doos mounted, read before the check's own
|
|
command could remount it) is `proc`, matching `doMount("proc", ..., "proc", ...)` in
|
|
`src/sandbox.cpp`.
|
|
|
|
|
|
## Caveats
|
|
|
|
Confirms doos's own `/proc` mount is what it claims to be at container start; it does
|
|
not attempt the image-controlled mount-target substitution runc's bug needed, since doos
|
|
has no AppArmor profile for that substitution to bypass in the first place.
|
|
|
|
|
|
Run: `make test` in this directory, or `make -C audit test` from the repo root.
|