[Buildroot] [git commit] package/runc: add upstream security fix for CVE-2019-5736
Peter Korsgaard
peter at korsgaard.com
Thu Feb 21 12:53:26 UTC 2019
>>>>> "Peter" == Peter Korsgaard <peter at korsgaard.com> writes:
> commit: https://git.buildroot.net/buildroot/commit/?id=6e3f7fbc072c88ab344f2ffa39e402464b566f19
> branch: https://git.buildroot.net/buildroot/commit/?id=refs/heads/master
> The vulnerability allows a malicious container to (with minimal user
> interaction) overwrite the host runc binary and thus gain root-level
> code execution on the host. The level of user interaction is being able
> to run any command (it doesn't matter if the command is not
> attacker-controlled) as root within a container in either of these
> contexts:
> * Creating a new container using an attacker-controlled image.
> * Attaching (docker exec) into an existing container which the
> attacker had previous write access to.
> For more details, see the advisory:
> https://www.openwall.com/lists/oss-security/2019/02/11/2
> The fix for this issue uses fexecve(3), which isn't available on uClibc, so
> add a dependency on !uclibc to runc and propagate to the reverse
> dependencies (containerd/docker-engine).
> Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
Committed to 2018.11.x, thanks.
I have so far NOT backported it to 2018.02.x as it requires a bump of
the entire docker stack, and given that 2018.02 is very close to EOL I
suggest affected users (using docker on a writable rootfs with untrusted
containers) instead move to 2019.02.
--
Bye, Peter Korsgaard
More information about the buildroot
mailing list