Red Hat announced a vulnerability this morning – one that can be exploited if a user runs malicious or modified containers. The flaw in runC (a lightweight portable container runtime) and Docker that this vulnerability exposes allows an attacker to escape a container and access the underlying file system. That might sound bad, but there’s more.
The good news is that this vulnerability cannot be exploited if SELinux is enabled and that this is the default on Red Hat systems. To check whether your Red Hat system is enforcing SELinux, use one of the following commands:
$ /usr/sbin/getenforce Enforcing$ sestatus SELinux status: enabledThis vulnerability also requires local access to the system. Affected Red Hat systems include:
- Red Hat OpenShift Container Platform 3.x
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated
- Red Hat Enterprise Linux 7
The status of the vulnerability is rated as IMPORTANT. To see descriptions of this and other possible vulnerability security ratings, visit Issue Severity Classification page.
To review SELinux security modes and commands for moving between them, visit this PERMANENT CHANGES IN SELINUX STATES AND MODES.
Instructions to customers will be continuallly updated at updates.
A blog post outlining the vulnerability, it’s impact on operations, and Red Hat’s work with SELinux is also available at It starts with Linux.
Closing thoughts
Scott McCarty, principal product manager, Containers at Red Hat put out this important reminder:
“This vulnerability (CVE-2019-5736) demonstrates that container security is Linux security. The same steps that must be taken to better secure a Linux system need to be taken with container hosts and images, preferably by constructing layers of defense. In this particular case, SELinux mitigates the escape and buys users valuable time to patch and shows just how important the selection of each layer of your container environment can be, from Kubernetes orchestration with OpenShift down to the Linux kernel in Red Hat Hat Enterprise Linux.”
