Stay Secure with the Latest Linux Advisories

security advisorysecurity issuerunc

Mageia: 2019-0068 Moderate: opencontainers-runc Memory Modification Issue

Not using pivot_root(2) leaves the host /proc around in the mount namespace so that it is possible to mount another /proc without any other submount, even if /proc in the container is not fully visible. This flaw allows an attacker to read and modify some parts of the Linux kernel memory (rhbz#1663068). . MGASA-2019-0068 - Updated opencontainers-runc packages fix security vulnerability Publication date: 13 Feb 2019 URL: https://advisories.mageia.org/MGASA-2019-0068.html Type: security Affected Mageia releases: 6 CVE: CVE-2019-5736 Not using pivot_root(2) leaves the host /proc around in the mount namespace so that it is possible to mount another /proc without any other submount, even if /proc in the container is not fully visible. This flaw allows an attacker to read and modify some parts of the Linux kernel memory (rhbz#1663068). runc through 1.0-rc6 allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: a new container with an attacker-controlled image, or an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe (CVE-2019-5736). References: - https://bugs.mageia.org/show_bug.cgi?id=24253 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/SMFQ54VEZPJT4H2C2TBILCPDX2VMAIZ2/ - https://www.openwall.com/lists/oss-security/2019/02/11/2 - https://www.cve.org/CVERecord?id=CVE-2019-5736 SRPMS: - 6/core/opencontainers-runc-1.0.0rc5-3.2.mga6 . Revised opencontainers-runc updates address security vulnerabilities that might permit unauthorized access to host memory and executable commands.. Opencontainers-Runc, Mageia Security, Container Access, Kernel Security Issue. . LinuxSecurity.com Team

Feb 13, 2019 Mageia