44 lines
2.1 KiB
Markdown
44 lines
2.1 KiB
Markdown
# CVE-2019-5736: runc container escape via /proc/self/exe overwrite
|
|
|
|
**Scope:** [audit](../README.md) · [README](../../README.md) · [COMPARISON](../../COMPARISON.md) · [docs/RESEARCH](../../docs/RESEARCH.md)
|
|
|
|
CVSS 7.2. Fixed in runc 1.0.0-rc7, Docker 18.09.2.
|
|
|
|
## Source
|
|
|
|
- [Ubuntu security notice](https://discourse.ubuntu.com/t/runc/55877)
|
|
- [Trend Micro writeup](https://www.trendmicro.com/vinfo/be/security/news/vulnerabilities-and-exploits/cve-2019-5736-runc-container-escape-vulnerability-provides-root-access-to-the-target-machine)
|
|
|
|
## Relevance to doos
|
|
|
|
runc re-executes itself through `/proc/self/exe` as part of its container-start
|
|
sequence. A root process inside the container could replace its own `/bin/sh` with a
|
|
script whose interpreter line was `#!/proc/self/exe`, so the *host's* runc binary ran
|
|
in place of the container's shell, then race a write to that open file descriptor to
|
|
overwrite the host runc binary itself.
|
|
|
|
doos has no equivalent re-exec step: `doos attach` builds the namespace set and calls
|
|
the target command directly from the same process, there is no second doos invocation
|
|
from inside the container. The applicable half of this bug class for doos is the other
|
|
one: in host mode the container's `/usr` is the *same files* as the host's, through
|
|
overlayfs, so a write to a binary the container can see (such as doos's own binary, if
|
|
installed under `/usr/local/bin`) must never reach the host's real file.
|
|
|
|
|
|
## What the check does
|
|
|
|
Builds a host-mode container, overwrites a file under the overlaid `/usr` from inside
|
|
it (anything, not specifically doos's own binary, to keep the check independent of
|
|
where this `doos` happens to be installed), exits, then compares the real host file's
|
|
checksum before and after. A difference is FAIL.
|
|
|
|
|
|
## Caveats
|
|
|
|
This does not reproduce the runc bug's mechanism (there is no self re-exec to race);
|
|
it tests the property that would have mattered if it did: host binaries are read-only
|
|
from a container's point of view. Needs `sha256sum` and a host-mode attach to work.
|
|
|
|
|
|
Run: `make test` in this directory, or `make -C audit test` from the repo root.
|