Solution and Step to fix CVE-2019-5736 Vulnerability - Docker

Recently a new vulnerability has been discovered in the the internet market having target to Docker services.

What is this Vulnerability:

In short, Docker service uses another service called as runc which is container run time to spawn and run containers. which simply means if docker task is to create docker images then runc task would be running them and attaching a process to container.

So as per the recent discovery by the maintainers of runc, the code of this service was having some bug which can be used by attackers to gain the root level of access of the host machine on which docker containers are running.

How it can be Exploited:

This vulnerability can be exploited in two ways (1) if the docker images are in use is vulnerable making the containers build from it vulnerable also (2) if somehow attacker got the access of containers and then trying to exploit using the bug present in runc and trying to get root privileges.

Solution to Fix Vulnerability:

Centos/Redhat

• Update the docker version to latest version 18.09.2

           Example: docker-ce-18.09.2

AWS

• Update the docker version to latest version 18.06.1ce

           Example:docker-18.06.1ce-7.25.amzn1

Note: For AWS environment, you might need to disable /etc/yum/pluginconf.d/update-motd.conf file by changing it to Zero "0" from One "1" to view the available AWS package.

Recommended Step:

Along with package update , we should also consider deploying containers using some random users rather than root user as the vulnerability gets exploited when having “UID 0” i.e root privileges inside container.

So when you are using composer file to define images, make sure to define some unique users to run those containers and which also need to present on server on which this containers need to run.

====================================X============X=================================================

Contact support@linuxforeveryone for any Freelancing work on Linux Servers

Subscribe my YouTube Channel 

Like My Facebook Page 

Browse the Best in class Web Hosting Plans

Linuxforeveryone started with the focus of solving linux related issues a sys admin faces everyday. So as System Admin whatever i learn through my experience i try to write it down for rest of opensource community.

If you appreciate what you have read or this blog writeup helped you can considering buying me COFFEE, this will help me keep writing and helping community further.