Breaking Out of rkt – 3 New Unpatched CVEs
Summary: A Unit 42 researcher found three unpatched vulnerabilities in the CoreOS rkt container runtime that let an attacker compromise the host when a user runs 'rkt enter' into an attacker-controlled pod, because binaries executed that way run as root with all capabilities and no seccomp filtering or cgroup isolation. Red Hat, which acquired CoreOS in mid-2018 and has not released rkt since April 2018, acknowledged the issues and assigned CVE IDs but stated it has no active plan or timeline to fix them, so the researcher disclosed them via a GitHub issue on 30.05.19.
What's compelling: The runtime's last release was April 2018 and its owner has said it will not patch these flaws, so any team still running rkt in production is carrying host-compromise risk with no vendor fix coming - the researcher's only guidance is to avoid 'rkt enter' entirely.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5736
- Related