2.1 KiB
CVE-2019-5736: runc container escape via /proc/self/exe overwrite
Scope: audit · README · COMPARISON · docs/RESEARCH
CVSS 7.2. Fixed in runc 1.0.0-rc7, Docker 18.09.2.
Source
Relevance to doos
runc re-executes itself through /proc/self/exe as part of its container-start
sequence. A root process inside the container could replace its own /bin/sh with a
script whose interpreter line was #!/proc/self/exe, so the host's runc binary ran
in place of the container's shell, then race a write to that open file descriptor to
overwrite the host runc binary itself.
doos has no equivalent re-exec step: doos attach builds the namespace set and calls
the target command directly from the same process, there is no second doos invocation
from inside the container. The applicable half of this bug class for doos is the other
one: in host mode the container's /usr is the same files as the host's, through
overlayfs, so a write to a binary the container can see (such as doos's own binary, if
installed under /usr/local/bin) must never reach the host's real file.
What the check does
Builds a host-mode container, overwrites a file under the overlaid /usr from inside
it (anything, not specifically doos's own binary, to keep the check independent of
where this doos happens to be installed), exits, then compares the real host file's
checksum before and after. A difference is FAIL.
Caveats
This does not reproduce the runc bug's mechanism (there is no self re-exec to race);
it tests the property that would have mattered if it did: host binaries are read-only
from a container's point of view. Needs sha256sum and a host-mode attach to work.
Run: make test in this directory, or make -C audit test from the repo root.