Bug 1796107 (CVE-2019-19921)

Summary:	CVE-2019-19921 runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adimania, admiller, amurdaca, aos-bugs, bbaude, bmontgom, dbecker, dornelas, dwalsh, eparis, gscrivan, ichavero, ikavalio, jburrell, jcajka, jchaloup, jjoyce, jnovy, jokerman, jschluet, kbasil, lhh, lpeer, lsm5, mburns, mpatel, nalin, nstielau, o.lemasle, rh.container.bot, rhos-maint, santiago, sclewis, slinaber, sponnaga, TicoTimo, tsweeney, vbatts
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	runc 1.0.0-rc10	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in runc. An attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization, by adding a symlink to the rootfs that points to a directory on the volume. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-10 16:31:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1796109, 1796110, 1796112, 1801886, 1801887, 1801888, 1802599, 1803100, 1804040, 1804041, 1804042, 1804043, 1890047, 1890048, 1890050, 1890052
Bug Blocks:	1796113

Description Marian Rehak 2020-01-29 16:01:52 UTC

An attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization, by adding a symlink to the rootfs that points to a directory on the volume.

Upstream Issue:

https://github.com/opencontainers/runc/issues/2197

Comment 1 Marian Rehak 2020-01-29 16:03:01 UTC

Created docker tracking bugs for this issue:

Affects: fedora-all [bug 1796110]
Affects: openstack-rdo [bug 1796112]


Created runc tracking bugs for this issue:

Affects: fedora-all [bug 1796109]

Comment 3 Marco Benatto 2020-02-11 20:19:36 UTC

Upstream commit for this issue:
https://github.com/opencontainers/runc/pull/2207/commits/3291d66b98445bd7f7d02eac7f2bca2ac2c56942

Comment 5 Daniel Walsh 2020-02-11 20:37:19 UTC

Jindrich can you get an update out for this?

Comment 11 errata-xmlrpc 2020-03-10 12:21:24 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.2

Via RHSA-2020:0688 https://access.redhat.com/errata/RHSA-2020:0688

Comment 12 Product Security DevOps Team 2020-03-10 16:31:56 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19921

Comment 13 errata-xmlrpc 2020-03-12 21:18:03 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2020:0695 https://access.redhat.com/errata/RHSA-2020:0695

Comment 15 errata-xmlrpc 2020-03-23 13:52:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extras

Via RHSA-2020:0942 https://access.redhat.com/errata/RHSA-2020:0942

Comment 16 errata-xmlrpc 2020-04-20 17:21:34 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.3

Via RHSA-2020:1485 https://access.redhat.com/errata/RHSA-2020:1485

Comment 17 errata-xmlrpc 2020-04-28 15:36:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1650 https://access.redhat.com/errata/RHSA-2020:1650