Critical Vulnerability in LXC Package: Host Root Access via runc Exploit
Summary
ALPINE-CVE-2019-5736: runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as r... Affects lxc versions < 3.1.0-r1. Fixed in 3.1.0-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LXC (Linux Containers) is a userspace interface for the Linux kernel containment features. It allows users to create and manage lightweight, secure containers. The LXC package is widely used for deploying applications in isolated environments, providing a flexible and efficient way to run multiple applications on a single host. However, it has been found to be vulnerable to a critical security flaw that could allow attackers to gain unauthorized root access to the host system.
Vulnerability Detail
The vulnerability, identified as CVE-2019-5736, arises from a flaw in runc, which is the underlying container runtime used by LXC and Docker. This issue allows attackers to overwrite the host runc binary by executing commands as root within a container. The exploit can be executed in two scenarios: by creating a new container with a malicious image or by attaching to an existing container where the attacker previously had write access. This vulnerability is particularly dangerous as it can lead to complete host compromise, allowing attackers to gain root access and control over the entire system.
How To Fix
Minimum fixed version
3.1.0-r1
This is the first release that contains the fix.
sudo apk add --upgrade lxcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, it is recommended to restrict access to containers and limit the ability to execute commands as root within them. Additionally, avoid using untrusted images for container creation.
Conclusion
The CVE-2019-5736 vulnerability in the LXC package poses a significant risk by allowing attackers to gain root access to the host system. It is crucial to update to the patched version 3.1.0-r1 or later to mitigate this risk. Implementing workarounds can provide temporary relief, but a full update is the best course of action.
See every vulnerability recorded for lxc →
FAQ
CVE-2019-5736 is a critical vulnerability in the runc component used by LXC and Docker, allowing attackers to overwrite the host runc binary and gain root access.
You can use Vulert, which monitors open-source vulnerabilities in your software without needing access to the code. Visit Vulert Scanner to check your application.
The CVSS score for CVE-2019-5736 is 8.6, indicating a high severity level.
If immediate updates are not possible, restrict access to the containers and avoid using untrusted images as a temporary measure.
You can find more information on the official LXC documentation site and security advisories related to the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for lxc.
