Security update for docker-runc (important)

openSUSE Security Update: Security update for docker-runc Announcement ID: openSUSE-SU-2019:0252-1 Rating: important References: 1121967 Cross-References: CVE-2019-5736 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for...

SUSE SLED15 / SLES15 Security Update : containerd, docker, docker-runc, golang-github-docker-libnetwork, runc (SUSE-SU-2019:0495-1)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues : Security issues fixed : CVE-2018-16875: Fixed a CPU Denial of Service bsc1118899. CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPA...

SUSE-SU-2019:0495-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues: Security issues fixed: - CVE-2018-16875: Fixed a CPU Denial of Service bsc1118899. - CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in...

ThreatList: APT Adversaries Up the Ante on Speed, Target Telecom

Despite law-enforcement wins in the form of several high-profile arrests and indictments during 2018, nation-state adversaries have upped their games when it comes to speed. That’s according to CrowdStrike’s 2019 Global Threat Report, which found that when analyzing how long it takes to go from...

openSUSE Security Update : docker-runc (openSUSE-2019-201)

This update for docker-runc fixes the following issues : Security issue fixed : - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout bsc1121967 This update was imported from the SUSE:SLE-12:Upda...

Security update for docker-runc (important)

openSUSE Security Update: Security update for docker-runc Announcement ID: openSUSE-SU-2019:0201-1 Rating: important References: 1121967 Cross-References: CVE-2019-5736 Affected Products: openSUSE Leap 42.3 An update that fixes one vulnerability is now available. Description: This update for...

runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)

Exploit for linux platform in category local exploits runc . + constructed fdpath + badinit is ready -- see for logs. dying to allow /proc/self/exe to be unused... % cat /usr/sbin/docker-runc !/bin/bash touch /w00tw00t ; cat /etc/shadow And now if you try to use Docker normally, t...

SUSE SLES15 Security Update : docker-runc (SUSE-SU-2019:0362-1)

This update for docker-runc fixes the following issues : Security issue fixed : CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout bsc1121967 Note that Tenable Network Security has extracted the...

SUSE-SU-2019:0385-1 Security update for docker-runc

This update for docker-runc fixes the following issues: Security issue fixed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout bsc1121967...

OPENSUSE-SU-2019:0170-1 Security update for runc

This update for runc fixes the following issues: Security vulnerabilities addressed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout bsc1121967 - CVE-2018-16873: Fix a remote command...

SUSE-SU-2019:0362-1 Security update for docker-runc

This update for docker-runc fixes the following issues: Security issue fixed: - CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout bsc1121967...

runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)

CVE-2019-5736 This is exploit code for CVE-2019-5736 and it works for both runc and LXC. The simplest way to use it is to copy the exploit code into an existing container, and run make.sh. However, you could just as easily create a bad image and run that. console % docker run --rm --name pwnme -d...

runc 1.0-rc6 (Docker 18.09.2) - Container Breakout (2)

runc 1.0-rc6 Docker 18.09.2 - Container Breakout 2 CVE-2019-5736 This is exploit code for CVE-2019-5736 and it works for both runc and LXC. The simplest way to use it is to copy the exploit code into an existing container, and run make.sh. However, you could just as easily create a bad image and...

CVE-2019-5736: runC container breakout | Cloud Foundry

Severity High Vendor Open Container Initiative Affected Cloud Foundry Products and Versions Severity is High unless otherwise noted. BPM All prior to v1.0.3 Cloud Foundry Container Runtime CFCR All versions prior to v0.29.0 Docker BOSH Release All versions prior to v34.0.0 Garden runC All version...

Security update for runc (important)

openSUSE Security Update: Security update for runc Announcement ID: openSUSE-SU-2019:0170-1 Rating: important References: 1095817 1118897 1118898 1118899 1121967 Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 CVE-2019-5736 Affected Products: openSUSE Backports SLE-15 An update tha...

Attacking Containers and runC

This week a new vulnerability was published CVE-2019-5736 that highlights everything bad and good about containers. Simply put, this vulnerability can be exploited using an infected container to attack the host. It’s a real world example of a breakout attack that has long been a major concern in...

runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (1)

Usage Edit HOST inside payload.c, compile with make. Start nc and run pwn.sh inside the container. Notes - This exploit is destructive: it'll overwrite /usr/bin/docker-runc binary on the host with the payload. It'll also overwrite /bin/sh inside the container. - Tested only on Debian 9. - No...

gVisor runsc Guest -> Host Breakout Via Filesystem Cache Desync

Exploit for linux platform in category dos / poc gVisor runsc guest-host breakout via filesystem cache desync The following writeup describes an attack that can be used to overwrite files in the host filesystem /etc/crontab in my PoC from inside a Docker container that uses gVisor's runsc. I test...

MGASA-2018-0398 Updated docker packages fix security vulnerabilities

Updated docker packages fix security vulnerabilities: Lack of content verification in docker allowed a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing CVE-2017-14992. The DefaultLinuxSpec function in oci/defaults.go docker did not block /proc/scsi...

Updated docker packages fix security vulnerabilities

Updated docker packages fix security vulnerabilities: Lack of content verification in docker allowed a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing CVE-2017-14992. The DefaultLinuxSpec function in oci/defaults.go docker did not block /proc/scsi...