About the February 2019 Cri-O / RunC / Docker vulnerability

What OpenShift Online and OpenShift Dedicated customers should know about the recently announced vulnerability of runc/docker/CRI-O

On February 11th, 2019, details of a vulnerability that researchers have confirmed is present on certain versions of runc (impacting docker and CRI-O) was published.  These tools are deployed as part of the OpenShift product and impact the Red Hat OpenShift hosted properties.

OpenShift Online

The Starter and Pro tiers are affected by the vulnerability, but known exploits are mitigated by the SELinux configuration deployed on cluster nodes.  As soon as the patched runc, docker, and/or CRI-O code is available, the SRE team will update the cluster infrastructure.

OpenShift Dedicated

The OSD environment is also affected by the vulnerability, but known exploits are mitigated by the SELinux configuration deployed to cluster nodes.  The SRE team will update the cluster infrastructure as soon as the patched runc and docker code is available. OSD customers will be communicated to separately regarding cluster remediation.

Additional Reading

CVE details: https://access.redhat.com/security/cve/cve-2019-5736

Public announcement: https://seclists.org/oss-sec/2019/q1/119