CVE-2019-5736 - Vulnerable Docker runc Service

CVE-2019-5736: runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows an attacker to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers:  (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec.   This occurs because of file-descriptor mishandling, related to /proc/self/exe.

CVE-2019-16884: runc through 1.0.0-rc8,  as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

Background Information

Open Container Initiative (OCI)

The Open Container Initiative (OCI) is a lighweight, open governance structure (project), formed under the auspices of the Linux Foundation, for the express purpose of creating open industry standards around container formats and runtime.  The OCI was launched on the 22nd June 2015 by Docker, CoreOS and other leaders in the container industry.  Docker donated the container image specification and runtime code now known as runc, to the OCI in order to help establish standardisation in the container ecosystem.   Container runtimes are often divided into two (2) categories - low-level (runc, gVisor,  Firecracker) and high-level (containerd, Docker, CRI-O, podman).  The difference between them is the amount of consumed OCI specification and additional features.

Linux Containers

A Linux container is a set of one (1) or more processes that are isolated from the rest of the operating system.  All files necessary to run them are provided from a distinct image, ensuring that the linux containers are portable and consistent as they move from development, to testing and finally to production.

Containers share the same operating system kernel while isolating the application processes from the rest of the system however the container must be compatible with the underlying operating system.  ARM Linux systems run on ARM Linux containers, x86 Linux systems run x86 Linux containers, x86 Windows systems run x86 Windows containers.   Because all of the containers share the services of a single operating system kernel,  they use fewer resources than virtual machines.

Docker

Docker Inc., was founded, in France, in 2008 by Kamel Founadi, Solomon Hykes and Selastien Pahl and incorporated in the United States in 2010.  

The Docker container technology was launched, in 2013, as an open source Docker Engine.   Docker is a set of of tools that use operating system-level virtualization to develop and deliver software in packages called containers.  A container is a sandbox process on a machine that is isolated from all other processes on the host machine.  The isolation of the process is achieved through the use of linux features such as linux kernel namespaces and cgroups.  

Docker containers are isolated from each other, with their own software, libraries and configuration files.  All containers are run by a single host operating system kernel and are thus more lightweight than virtual machines.  They are instantiated from Docker images that specify their precise contents.  Images can also be created by combining and modifying existing standard images downloaded from public repositories,  known as image registries.  An instance of an image (a container) thus contains configured networking, storage, logging, etc.  Furthermore, Docker defines an abstraction for these machine-specific settings and the exact same Docker container can run without any changes on many different machines with many different configurations.  

The Docker software as a service consist of three components, Software, Objects and Registries.  

Docker Software