Bug 1796107 (CVE-2019-19921)

Summary: CVE-2019-19921 runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adimania, admiller, amurdaca, aos-bugs, bbaude, bmontgom, dbecker, dornelas, dwalsh, eparis, gscrivan, ichavero, ikavalio, jburrell, jcajka, jchaloup, jjoyce, jnovy, jokerman, jschluet, kbasil, lhh, lpeer, lsm5, mburns, mpatel, nalin, nstielau, o.lemasle, rh.container.bot, santiago, sclewis, slinaber, sponnaga, TicoTimo, tsweeney, vbatts
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: runc 1.0.0-rc10 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-10 16:31:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1796110, 1890047, 1890048, 1890050, 1890052, 1796109, 1796112, 1801886, 1801887, 1801888, 1802599, 1803100, 1804040, 1804041, 1804042, 1804043    
Bug Blocks: 1796113    

Description Marian Rehak 2020-01-29 16:01:52 UTC
An attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization, by adding a symlink to the rootfs that points to a directory on the volume.

Upstream Issue:

https://github.com/opencontainers/runc/issues/2197

Comment 1 Marian Rehak 2020-01-29 16:03:01 UTC
Created docker tracking bugs for this issue:

Affects: fedora-all [bug 1796110]
Affects: openstack-rdo [bug 1796112]


Created runc tracking bugs for this issue:

Affects: fedora-all [bug 1796109]

Comment 3 Marco Benatto 2020-02-11 20:19:36 UTC
Upstream commit for this issue:
https://github.com/opencontainers/runc/pull/2207/commits/3291d66b98445bd7f7d02eac7f2bca2ac2c56942

Comment 5 Daniel Walsh 2020-02-11 20:37:19 UTC
Jindrich can you get an update out for this?

Comment 11 errata-xmlrpc 2020-03-10 12:21:24 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.2

Via RHSA-2020:0688 https://access.redhat.com/errata/RHSA-2020:0688

Comment 12 Product Security DevOps Team 2020-03-10 16:31:56 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19921

Comment 13 errata-xmlrpc 2020-03-12 21:18:03 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2020:0695 https://access.redhat.com/errata/RHSA-2020:0695

Comment 15 errata-xmlrpc 2020-03-23 13:52:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extras

Via RHSA-2020:0942 https://access.redhat.com/errata/RHSA-2020:0942

Comment 16 errata-xmlrpc 2020-04-20 17:21:34 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.3

Via RHSA-2020:1485 https://access.redhat.com/errata/RHSA-2020:1485

Comment 17 errata-xmlrpc 2020-04-28 15:36:44 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1650 https://access.redhat.com/errata/RHSA-2020:1650