CVE-2019-5736
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2019-5736 lxc Corrigé dans: 3.1.0-r1
- Debian DEBIAN-CVE-2019-5736 lxc Corrigé dans: 1:3.1.0+really3.0.3-4
Références
- advisory lists.opensuse.org
- advisory lists.opensuse.org
- advisory lists.opensuse.org
- advisory lists.opensuse.org
- advisory lists.opensuse.org
- advisory lists.opensuse.org
- advisory lists.opensuse.org
- advisory lists.opensuse.org
- advisory lists.opensuse.org
- advisory lists.opensuse.org
- advisory packetstormsecurity.com
- advisory openwall.com
- advisory openwall.com
- advisory openwall.com
- advisory openwall.com
- advisory openwall.com
- advisory openwall.com
- advisory securityfocus.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory aws.amazon.com
- advisory cloud.google.com
- advisory github.com
- advisory github.com
- advisory kubernetes.io
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory softwaresupport.softwaregrp.com
- advisory tools.cisco.com
- advisory usn.ubuntu.com
- advisory synology.com
- advisory twistlock.com
- patch azure.microsoft.com
- patch azure.microsoft.com
- patch bugzilla.suse.com
- patch github.com
- patch github.com
- patch support.mesosphere.com
- patch openwall.com
- report support.hpe.com
- report packetstormsecurity.com
- report blog.dragonsector.pl
- report brauner.github.io
- report github.com
- report github.com
- report exploit-db.com
- report exploit-db.com
- web openwall.com
- web openwall.com
- web openwall.com
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.apache.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org