Amazon Linux AMI update for runc
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 CVE-2019-19921 |
| CWE-ID | CWE-281 CWE-284 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #4 is available. |
| Vulnerable software |
Amazon Linux AMI Operating systems & Components / Operating system runc Operating systems & Components / Operating system package or component |
| Vendor | Amazon Web Services |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Improper Preservation of Permissions
EUVDB-ID: #VU74189
Risk: Low
CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-25809
CWE-ID:
CWE-281 - Improper preservation of permissions
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the rootless "/sys/fs/cgroup" is writable when cgroupns is not unshared. A local administrator can gain the write access to user-owned cgroup hierarchy "/sys/fs/cgroup/user.slice/..." on the host.
MitigationUpdate the affected packages:
aarch64:Vulnerable software versions
runc-debuginfo-1.1.5-1.amzn2023.0.1.aarch64
runc-1.1.5-1.amzn2023.0.1.aarch64
runc-debugsource-1.1.5-1.amzn2023.0.1.aarch64
src:
runc-1.1.5-1.amzn2023.0.1.src
x86_64:
runc-debuginfo-1.1.5-1.amzn2023.0.1.x86_64
runc-1.1.5-1.amzn2023.0.1.x86_64
runc-debugsource-1.1.5-1.amzn2023.0.1.x86_64
Amazon Linux AMI: All versions
runc: before 1.1.5-1
CPE2.3- cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*
- cpe:2.3:o:amazon_web_services:runc:*:*:*:*:*:amazon_linux_ami:*:*
https://alas.aws.amazon.com/AL2023/ALAS-2023-208.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper access control
EUVDB-ID: #VU74190
Risk: Low
CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-27561
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to improper access restrictions in the libcontainer/rootfs_linux.go. A local user can gain elevated privileges on the target system.
MitigationUpdate the affected packages:
aarch64:Vulnerable software versions
runc-debuginfo-1.1.5-1.amzn2023.0.1.aarch64
runc-1.1.5-1.amzn2023.0.1.aarch64
runc-debugsource-1.1.5-1.amzn2023.0.1.aarch64
src:
runc-1.1.5-1.amzn2023.0.1.src
x86_64:
runc-debuginfo-1.1.5-1.amzn2023.0.1.x86_64
runc-1.1.5-1.amzn2023.0.1.x86_64
runc-debugsource-1.1.5-1.amzn2023.0.1.x86_64
Amazon Linux AMI: All versions
runc: before 1.1.5-1
CPE2.3- cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*
- cpe:2.3:o:amazon_web_services:runc:*:*:*:*:*:amazon_linux_ami:*:*
https://alas.aws.amazon.com/AL2023/ALAS-2023-208.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper Preservation of Permissions
EUVDB-ID: #VU74193
Risk: Medium
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-28642
CWE-ID:
CWE-281 - Improper preservation of permissions
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to improper preservation of permissions in the AppArmor and SELinux when /proc inside the container is symlinked with a specific mount configuration. A remote attacker can gain access to the target application.
MitigationUpdate the affected packages:
aarch64:Vulnerable software versions
runc-debuginfo-1.1.5-1.amzn2023.0.1.aarch64
runc-1.1.5-1.amzn2023.0.1.aarch64
runc-debugsource-1.1.5-1.amzn2023.0.1.aarch64
src:
runc-1.1.5-1.amzn2023.0.1.src
x86_64:
runc-debuginfo-1.1.5-1.amzn2023.0.1.x86_64
runc-1.1.5-1.amzn2023.0.1.x86_64
runc-debugsource-1.1.5-1.amzn2023.0.1.x86_64
Amazon Linux AMI: All versions
runc: before 1.1.5-1
CPE2.3- cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*
- cpe:2.3:o:amazon_web_services:runc:*:*:*:*:*:amazon_linux_ami:*:*
https://alas.aws.amazon.com/AL2023/ALAS-2023-208.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Improper access control
EUVDB-ID: #VU25847
Risk: Low
CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2019-19921
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain unauthorized access to sensitive information.
The vulnerability exists due to improper access restrictions, related to libcontainer/rootfs_linux.go in runc. A local user with ability to spawn two containers with custom volume-mount configurations, and run custom images can escalate privileges on the system.
Update the affected packages:
aarch64:Vulnerable software versions
runc-debuginfo-1.1.5-1.amzn2023.0.1.aarch64
runc-1.1.5-1.amzn2023.0.1.aarch64
runc-debugsource-1.1.5-1.amzn2023.0.1.aarch64
src:
runc-1.1.5-1.amzn2023.0.1.src
x86_64:
runc-debuginfo-1.1.5-1.amzn2023.0.1.x86_64
runc-1.1.5-1.amzn2023.0.1.x86_64
runc-debugsource-1.1.5-1.amzn2023.0.1.x86_64
Amazon Linux AMI: All versions
runc: before 1.1.5-1
CPE2.3- cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*
- cpe:2.3:o:amazon_web_services:runc:*:*:*:*:*:amazon_linux_ami:*:*
https://alas.aws.amazon.com/AL2023/ALAS-2023-208.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
