Bug 1848239 (CVE-2020-14298) - CVE-2020-14298 docker: Security regression of CVE-2019-5736 due to inclusion of vulnerable runc
Summary: CVE-2020-14298 docker: Security regression of CVE-2019-5736 due to inclusion ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-14298
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1848413 1849099 1849946
Blocks: 1848236 1849011 1849161
TreeView+ depends on / blocked
 
Reported: 2020-06-18 04:05 UTC by Sam Fowler
Modified: 2021-02-16 19:51 UTC (History)
34 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host.
Clone Of:
Environment:
Last Closed: 2020-06-23 23:20:26 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:2762 0 None None None 2020-06-29 16:56:50 UTC
Red Hat Product Errata RHSA-2020:2653 0 None None None 2020-06-23 19:43:23 UTC

Description Sam Fowler 2020-06-18 04:05:30 UTC
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes.  One of the fixes regressed in that update was the fix for CVE-2019-5736, that was previously corrected in the docker packages in Red Hat Enterprise Linux 7 Extras via RHSA-2019:0304 (https://access.redhat.com/errata/RHSA-2019:0304).  The CVE-2020-14298 was assigned to this security regression and it is specific to the docker packages produced by Red Hat.

The original issue - CVE-2019-5736 - could possibly allow a privileged process inside container to compromise a process entering container namespace and execute arbitrary code outside of the container.  This could lead to compromise of the container host or other containers running on the same container host.  For more details about the original issue, see:

https://access.redhat.com/security/cve/CVE-2020-14298
https://access.redhat.com/security/vulnerabilities/runcescape
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-5736

This regression as corrected in docker-1.13.1-109.gitcccb291.el7_7 released via RHBA-2020:0427 (https://access.redhat.com/errata/RHBA-2020:0427).

Comment 3 Sam Fowler 2020-06-18 04:21:28 UTC
Mitigation:

This issue is mitigated on Red Hat Enterprise Linux 7 if SELinux is in enforcing mode, which prevents containers from escaping to the host machine.

Comment 11 Clifford Perry 2020-06-19 21:00:34 UTC
Statement:

This issue only affects a single version of docker, 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.

This issue is not exploitable on Red Hat Enterprise Linux Atomic Host 7 as the exploit requires replacement of the docker-runc binary, which is stored on a read-only filesystem and cannot be overwritten.

Comment 17 errata-xmlrpc 2020-06-23 19:43:20 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extras

Via RHSA-2020:2653 https://access.redhat.com/errata/RHSA-2020:2653

Comment 18 Product Security DevOps Team 2020-06-23 23:20:26 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14298


Note You need to log in before you can comment on or make changes to this bug.