A old vulnerability in Alpine Linux containers has spread and propagated to as much as 20% of the containers on the Docker Store.

Nearly one in five of the most popular containers available on the Docker store have no password for root access. That's the finding of researcher Jerry Gamblin, building on work by researchers at Cisco Talos. The result could easily be hundreds of thousands of containers deployed with no functional password at all.

The finding is important because containers, most frequently with Docker as the container manager, are becoming popular for deploying virtualized applications (as opposed to completed virtualized servers deployed with products like VMware or Microsoft Hyper-V). As Docker puts it, "A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries, and settings." 

In order to save time, developers will often put a container image into a repository for reuse, or they'll look at a public repository, like GitHub or the Docker Store, to find containers built by others that they can download and use. If those publicly available containers have vulnerabilities, they can quickly spread across the Internet.

According to the original Cisco Talos report, the vulnerability began with "null" passwords for the root user in Docker images for Alpine Linux, a lightweight, container-specific Linux distribution very popular in container development.

The vulnerability, now designated CVE-2019-5021, was first discovered in 2015 and patched — but then eight days later someone replaced a patched file with another file that enabled the vulnerability. A series of testing errors allowed the vulnerable files to be retained and distributed until May of this year. The original Alpine Linux images have been repatched, but Gamblin found that many containers remain with the vulnerability intact.

Gamblin, who is principal security engineer at Kenna Security, says the need for development speed — a need that has made containers a more popular deployment option — also means best practices aren't always followed.

"I think we're at the point in containers where they're becoming more useful locally and in small company situations, and you're seeing fewer best practices used," he says. "It's developers, it's system admins, and just people testing software and running it on their local machines that blow by best practices in the name of speed."

The good news for developers and security professionals is that the technology issue around this vulnerability has been solved. It's now up to processes and practices to ensure secure containers are pulled from repositories and deployed.

Gamblin says he sees this as an issue security teams should be aware of but not lose sleep over. "It's a weakness, but it's not a structural weakness," he says.

As he pointed out in a blog post he wrote about the vulnerability: "Deploying containers that allow users to authenticate as root should be avoided at all costs, because authenticating as root is already outside the scope of 'best practices' for secure containers or generally in system."

Related Content:

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights