• United States
Unix Dweeb

Red Hat announces container flaw CVE-2019-5736

News Analysis
Feb 11, 20192 mins

A flaw in runC and Docker may allow access to underlying file systems when SELinux is not enabled.

Credit: Sandra Henry-Stocker

Red Hat announced a vulnerability this morning – one that can be exploited if a user runs malicious or modified containers. The flaw in runC (a lightweight portable container runtime) and Docker that this vulnerability exposes allows an attacker to escape a container and access the underlying file system. That might sound bad, but there’s more.

The good news is that this vulnerability cannot be exploited if SELinux is enabled and that this is the default on Red Hat systems. To check whether your Red Hat system is enforcing SELinux, use one of the following commands:

$ /usr/sbin/getenforce
$ sestatus
SELinux status:                 enabled	  

This vulnerability also requires local access to the system. Affected Red Hat systems include:

  • Red Hat OpenShift Container Platform 3.x
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Enterprise Linux 7

The status of the vulnerability is rated as IMPORTANT. To see descriptions of this and other possible vulnerability security ratings, visit Issue Severity Classification page.

To review SELinux security modes and commands for moving between them, visit this PERMANENT CHANGES IN SELINUX STATES AND MODES.

Instructions to customers will be continuallly updated at updates.

A blog post outlining the vulnerability, it’s impact on operations, and Red Hat’s work with SELinux is also available at It starts with Linux.

Closing thoughts

Scott McCarty, principal product manager, Containers at Red Hat put out this important reminder:

“This vulnerability (CVE-2019-5736) demonstrates that container security is Linux security. The same steps that must be taken to better secure a Linux system need to be taken with container hosts and images, preferably by constructing layers of defense. In this particular case, SELinux mitigates the escape and buys users valuable time to patch and shows just how important the selection of each layer of your container environment can be, from Kubernetes orchestration with OpenShift down to the Linux kernel in Red Hat Hat Enterprise Linux.”

Unix Dweeb

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she's chasing the bears away from her bird feeders.

The opinions expressed in this blog are those of Sandra Henry-Stocker and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.

More from this author