it.ucsf.edu

Security Update:NCCIC is aware of a vulnerability affecting several open-source container management systems that leverage runc.

Status Type

Security Update

Date and Time

Thursday, February 14, 2019 - 13:41

Reason

Security update

Impact

Users of open-source container management systems that leverage runc.

WHAT HAPPENED?

The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), is aware of a vulnerability affecting several open-source container management systems that leverage runc.

 

Advanced Users: For a complete description of the security advisory go to:

 

AFFECTED SYSTEMS:

  • Several open-source container management systems that leverage runc; such as Red Hat and Docker

 

WHAT’S THE PROBLEM?

The vulnerability allows a malicious container, with minimal user interaction, to overwrite the host runc binary and gain root-level access on the host.

 

HOW DO I PROTECT MY CONTAINER MANAGEMENT SYSTEM

Go to the advisory listed above for patching information.

 

RELATED LINKS