Vulnerability Leaves Container Images Without Passwords

Nearly one in five of the most popular containers available on the Docker store have no password for root access. That's the finding of researcher Jerry Gamblin, building on work by researchers at Cisco Talos. The result could easily be hundreds of thousands of containers deployed with no functional password at all.

The finding is important because containers, most frequently with Docker as the container manager, are becoming popular for deploying virtualized applications (as opposed to completed virtualized servers deployed with products like VMware or Microsoft Hyper-V). As Docker puts it, "A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries, and settings." 

In order to save time, developers will often put a container image into a repository for reuse, or they'll look at a public repository, like GitHub or the Docker Store, to find containers built by others that they can download and use. If those publicly available containers have vulnerabilities, they can quickly spread across the Internet.

According to the original Cisco Talos report, the vulnerability began with "null" passwords for the root user in Docker images for Alpine Linux, a lightweight, container-specific Linux distribution very popular in container development.

The vulnerability, now designated CVE-2019-5021, was first discovered in 2015 and patched — but then eight days later someone replaced a patched file with another file that enabled the vulnerability. A series of testing errors allowed the vulnerable files to be retained and distributed until May of this year. The original Alpine Linux images have been repatched, but Gamblin found that many containers remain with the vulnerability intact.

Gamblin, who is principal security engineer at Kenna Security, says the need for development speed — a need that has made containers a more popular deployment option — also means best practices aren't always followed.

"I think we're at the point in containers where they're becoming more useful locally and in small company situations, and you're seeing fewer best practices used," he says. "It's developers, it's system admins, and just people testing software and running it on their local machines that blow by best practices in the name of speed."

The good news for developers and security professionals is that the technology issue around this vulnerability has been solved. It's now up to processes and practices to ensure secure containers are pulled from repositories and deployed.

Gamblin says he sees this as an issue security teams should be aware of but not lose sleep over. "It's a weakness, but it's not a structural weakness," he says.

As he pointed out in a blog post he wrote about the vulnerability: "Deploying containers that allow users to authenticate as root should be avoided at all costs, because authenticating as root is already outside the scope of 'best practices' for secure containers or generally in system."

Related Content: