CVE-2020-14298: 
Docker vulnerability analysis and mitigation

CVE-2020-14298 is a security regression vulnerability that affected Docker packages in Red Hat Enterprise Linux 7 Extras. The vulnerability was introduced in docker-1.13.1-108.git4ef4b30.el7 released on January 8th, 2020, and was subsequently fixed in docker-1.13.1-109.gitcccb291.el7_7 released on February 4th, 2020. This CVE represents a regression of a previously fixed security flaw (CVE-2019-5736) that was originally addressed in RHSA-2019:0304. The vulnerability affects Red Hat Enterprise Linux 7 Extras and Red Hat Enterprise Linux Atomic Host versions 7.7.3.1 & 7.7.4 (Red Hat Advisory).

The vulnerability occurred when the runc component was built from the master branch instead of the Red Hat specific branch, causing major patches including security fixes to be missing from the package. This issue allows a malicious or compromised container to compromise the container host and other containers running on the same host. The vulnerability is mitigated by SELinux when running in enforcing mode, as the SELinux policy prevents a process in the container from overwriting files on the host system that do not belong to the container, and files belonging to other containers (Red Hat Regression).

If exploited, this vulnerability could allow a malicious container to gain unauthorized access to the host system and other containers. The impact is particularly significant in environments where containers manage critical infrastructure, such as in Red Hat OpenStack Platform 13 where all services run as containers. However, the actual impact is substantially mitigated when SELinux is enabled in enforcing mode, which is the default configuration for most Red Hat products (Red Hat Regression).

The known exploit for this vulnerability requires overwriting the docker-runc binary. The exploitation can be prevented by placing the binary on a read-only file system, which prevents the overwrite attempt. Red Hat Enterprise Linux Atomic Host 7 uses a read-only file system for system binaries and therefore mitigates this issue by default (Red Hat Regression).

The primary mitigation is to update to docker version docker-1.13.1-109.gitcccb291.el7_7 or later. For systems that cannot be immediately updated, ensuring SELinux is enabled in enforcing mode provides significant protection against exploitation. Additionally, placing the docker-runc binary on a read-only filesystem prevents the known exploit method. Red Hat has provided both a vulnerability detection script and an Ansible playbook for automatic remediation (Red Hat Advisory).