Vulnerability CVE-2019-5736 Fix Announcement

runc Container Escape Vulnerability Fix Solution (CVE-2019-5736)

Solution

The following three methods can be used to choose the appropriate way to fix the security vulnerability:

1. Create a new Kubernetes cluster. Kubernetes 1.11.5 (Docker version) has been updated to 18.09.2, addressing the identified vulnerability.
2. Replace the nodes, scaling up to add new ones to the cluster, and scaling down older nodes after the container drift stabilizes. The Docker-runc on the scaled-up nodes resolves the vulnerability. This approach, however, may cause container drift and service traffic risks. When nodes are added to an existing 1.8 cluster, the new node's Docker version does not change. However, runc has been patched for vulnerabilities, and the scaled-up nodes in Kubernetes 1.11.1 or later are updated to Docker version 18.09.2.
3. Upgrade runc independently (this is especially recommended for 1.11 GPU clusters). Starting with Docker-18, Docker runc has been renamed to runc. The following solution applies to versions prior to Docker-18.

• Locate the Docker-runc and create a backup.

  Plain Text Copy

  1$ which docker-runc # normally /usr/bin/docker-runc
  2$ mv /usr/bin/docker-runc /usr/bin/docker-runc.orig.$(date -Iseconds)

• Perform the following to download the fixed runc:

  Plain Text Copy

  1$ curl -o /usr/bin/docker-runc https://baidu-container.cdn.bcebos.com/packages/runc/runc-v1.0.0-rc2
  2$ chmod +x /usr/bin/docker-runc

• Check whether runc executes normally

  Plain Text Copy

  1$ docker-runc -v
  2runc version 1.0.0-rc2
  3commit: b1adfd870be901735b1509e9560eec508bdfca1f
  4spec: 1.0.0-rc2-dev

• Check whether the docker works normally (the display will be different due to different versions and loads).

  Plain Text Copy

  1$ docker version
  2Client:
  3 Version:      17.03.2-ce
  4 API version:  1.27
  5 Go version:   go1.7.5
  6 Git commit:   f5ec1e2
  7 Built:        Tue Jun 27 01:35:00 2017
  8 OS/Arch:      linux/amd64
  9Server:
  10 Version:      17.03.2-ce
  11 API version:  1.27 (minimum version 1.12)
  12 Go version:   go1.7.5
  13 Git commit:   f5ec1e2
  14 Built:        Tue Jun 27 01:35:00 2017
  15 OS/Arch:      linux/amd64
  16 Experimental: false

Check the operation status of the container:

1$ docker ps
2CONTAINER ID        IMAGE                                                                                                                      COMMAND                  CREATED             STATUS              PORTS               NAMES
352d0c793caf9        hub-readonly.baidubce.com/public/pause:2.0                                                                                 "/pause"                 3 hours ago         Up 3 hours                              k8s_POD_node-exporter-klfks_kube-system_c8560cf5-3014-11e9-88b7-fa163e8b0a7e_0
49b6d830d4ba3        hub-readonly.baidubce.com/public/pause:2.0                                                                                 "/pause"                 3 hours ago         Up 3 hours                              k8s_POD_csi-bosplugin-g9ctz_kube-system_c855cf61-3014-11e9-88b7-fa163e8b0a7e_0

Security recommendations

Since the vulnerability is triggered by exploiting the UID 0 user in the container, it can be mitigated by setting the container's default user to a non-root user or utilizing Kubernetes' security restrictions.

• Restrict UID to non-0 by securityContext.

  Plain Text Copy

  1apiVersion: v1
  2kind: Pod
  3metadata:
  4  name: run-as-uid-1000
  5spec:
  6  securityContext:
  7    runAsUser: 1000

• Restrict the permissions of containers by PodSecurityPolicy.

  Plain Text Copy

  1apiVersion: policy/v1beta1
  2kind: PodSecurityPolicy
  3metadata:
  4  name: non-root
  5spec:
  6  privileged: false
  7  allowPrivilegeEscalation: false
  8  runAsUser:
  9    # Require the container to run without root privileges.
  10    rule: 'MustRunAsNonRoot'

Additionally, ensure all container images are audited and trusted. This can be achieved by either building the images yourself or reviewing their content and pinning them to a specific version hash.