|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2019-5736: lxc: container breakout vulnerability | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Karol Babioch <karol> |
| Component: | Incidents | Assignee: | Cédric Bosdonnat <cbosdonnat> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Major | ||
| Priority: | P3 - Medium | CC: | abergmann, asarai, carlos.lopez, cbosdonnat, meissner, rfrohl, smash_bz |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/223038/ | ||
| Whiteboard: | maint:planned:update | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Bug Depends on: | 1121967 | ||
| Bug Blocks: | |||
|
Description
Karol Babioch
2019-01-16 12:33:18 UTC
> Should we request it on your behalf?
Sure, that'd be great (though you'd probably want to submit it to Canonical's CNA).
(In reply to Aleksa Sarai from comment #1) > > Should we request it on your behalf? > > Sure, that'd be great (though you'd probably want to submit it to > Canonical's CNA). After speaking to the LXC maintainers, their view is that privileged containers cannot ever be safe and thus that this is not CVE-worthy (and so there's no point in submitting a CVE). This is outlined in their security threat model[1]: > LXC upstream's position is that those containers aren't and cannot be root-safe. [1]: https://linuxcontainers.org/lxc/security/ After talking to the upstream LXC maintainers at length, they have prepared a similar patch to the one I have for runc (I have a copy of it, though it might be outdated). They are going to follow the same CRD as CVE-2019-5736. As far as I'm aware we don't ship LXC for SLE so we can just pick up the upstream patches when they land. also published This is an autogenerated message for OBS integration: This bug (1122185) was mentioned in https://build.opensuse.org/request/show/689178 Factory / lxc This is an autogenerated message for OBS integration: This bug (1122185) was mentioned in https://build.opensuse.org/request/show/689418 Factory / lxc This is an autogenerated message for OBS integration: This bug (1122185) was mentioned in https://build.opensuse.org/request/show/691269 Factory / lxc This is an autogenerated message for OBS integration: This bug (1122185) was mentioned in https://build.opensuse.org/request/show/692121 Factory / lxc https://build.opensuse.org/request/show/692123 42.3 / lxc https://build.opensuse.org/request/show/692124 15.0 / lxc https://build.opensuse.org/request/show/692125 Backports:SLE-15 / lxc This is an autogenerated message for OBS integration: This bug (1122185) was mentioned in https://build.opensuse.org/request/show/692623 15.0 / lxc+lxcfs https://build.opensuse.org/request/show/692624 42.3 / lxc+lxcfs https://build.opensuse.org/request/show/692625 Backports:SLE-15 / lxc+lxcfs This is an autogenerated message for OBS integration: This bug (1122185) was mentioned in https://build.opensuse.org/request/show/692672 42.3 / lxc+lxcfs openSUSE-SU-2019:1227-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1122185,1131762,988348 CVE References: CVE-2018-6556,CVE-2019-5736 Sources used: openSUSE Backports SLE-15 (src): lxc-3.1.0-bp150.5.3.1, lxcfs-3.0.3-bp150.3.3.1 This is an autogenerated message for OBS integration: This bug (1122185) was mentioned in https://build.opensuse.org/request/show/696917 15.0 / lxc https://build.opensuse.org/request/show/696918 42.3 / lxc https://build.opensuse.org/request/show/696919 Backports:SLE-15 / lxc This is an autogenerated message for OBS integration: This bug (1122185) was mentioned in https://build.opensuse.org/request/show/697212 15.0 / lxc https://build.opensuse.org/request/show/697214 42.3 / lxc https://build.opensuse.org/request/show/697215 Backports:SLE-15 / lxc openSUSE-SU-2019:1275-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1122185,1131762,988348 CVE References: CVE-2018-6556,CVE-2019-5736 Sources used: openSUSE Leap 15.0 (src): lxc-3.1.0-lp150.2.10.1, lxcfs-3.0.3-lp150.2.3.1 (In reply to Aleksa Sarai from comment #3) > After speaking to the LXC maintainers, their view is that privileged > containers cannot ever be safe and thus that this is not CVE-worthy (and so > there's no point in submitting a CVE). This is outlined in their security > threat model[1]: > > > LXC upstream's position is that those containers aren't and cannot be root-safe. > > [1]: https://linuxcontainers.org/lxc/security/ Given this, and the infeasibility of the backport to SUSE:SLE-11-SP3:Update, I'm closing this bug and tracking that individual codestream as wontfix. |