CVE-2020-14300

docker: Security regression of CVE-2016-9962 due to inclusion of vulnerable runc

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for CVE-2016-9962, that was previously corrected in the docker packages in Red Hat Enterprise Linux 7 Extras via RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300 was assigned to this security regression and it is specific to the docker packages produced by Red Hat. The original issue - CVE-2016-9962 - could possibly allow a process inside container to compromise a process entering container namespace and execute arbitrary code outside of the container. This could lead to compromise of the container host or other containers running on the same container host. This issue only affects a single version of Docker, 1.13.1-108.git4ef4b30, shipped in Red Hat Enterprise Linux 7. Both earlier and later versions are not affected.

La versión de los paquetes docker docker-1.13.1-108.git4ef4b30.el7 según lo publicado para Red Hat Enterprise Linux 7 Extras por medio de RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) incluida una versión incorrecta de runc a la que le faltaban múltiples correcciones de bugs y seguridad. Una de las correcciones regresadas en esa actualización fue la corrección para CVE-2016-9962, que se corrigió previamente en los paquetes docker en Red Hat Enterprise Linux 7 Extras por medio de RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). El CVE-2020-14300 fue asignado a esta regresión de seguridad y es específico para los paquetes docker producidos por Red Hat. El problema original, CVE-2016-9962, podría permitir a un proceso dentro del contenedor comprometer un proceso que ingresa al espacio de nombres del contenedor y ejecutar código arbitrario fuera del contenedor. Esto podría comprometer el host del contenedor u otros contenedores que se ejecutan en el mismo host del contenedor. Este problema solo afecta a una versión única de Docker, 1.13.1-108.git4ef4b30, incluida en Red Hat Enterprise Linux 7. Las versiones anteriores y posteriores no están afectadas

The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2016-9962, which was previously fixed via RHSA-2017:0116. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-06-17 CVE Reserved
2020-06-23 CVE Published
2023-03-08 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-271: Privilege Dropping / Lowering Errors
CWE-273: Improper Check for Dropped Privileges

CAPEC

References (7)

URL	Tag	Source
https://access.redhat.com/security/cve/CVE-2016-9962	Not Applicable
https://access.redhat.com/security/vulnerabilities/cve-2016-9962	Not Applicable
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9962	Not Applicable

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/errata/RHBA-2020:0427	2023-02-12
https://access.redhat.com/security/cve/CVE-2020-14300	2020-06-23
https://bugzilla.redhat.com/show_bug.cgi?id=1848829	2020-06-23
https://access.redhat.com/security/vulnerabilities/runc-regression-docker-1.13.1-108	2020-06-23

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Docker Search vendor "Docker"		Docker Search vendor "Docker" for product "Docker"				1.13.1 Search vendor "Docker" for product "Docker" and version "1.13.1"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"				7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"		-		Affected