Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

More versions supported, fix bugs, allow Debian. (CVE-2024-21626) #18838

Merged
5 commits merged into from
Mar 18, 2024

Commits on Feb 15, 2024

  1. Wider runC version support, add Debian, fix bugs.

    Now uses the Rex::Version system to check the user's version of runC.
    The old system used to allow runC version 1.1.12 (which is patched).
    Now it allows from 1.0.0-rc93->1.1.11 (and I tested that it works as expected).
    Support added for Debian as this was tested with both Debian and Ubuntu.
    Newer versions of Docker wouldn't delete the built container due to the message format.
    I added a new regex to check for the message format which now deletes containers.
    
    Fixed error reporting bug, runC version sanitising
    
    Some runC versions contain the `+` and `~` token. These break
    Rex::Version objects. A simple check was added against these symbols
    and anything following them is cut off. Another solution may be
    to replace these tokens with the `-` symbol to maintain information.
    One of the failure cases was unreachable and this was fixed.
    
    Fix runC and docker presence checks
    
    The old runC and docker presence checks wer using `if` instead of `unless`.
    executable? also requires a full path to work correctly. Since only the command
    names themselves were being passed in, the check was silently failing.
    The chosen fix was to instead use the command_exists? function,
    which has the added benefit of working on both Windows and Linux.
    SickMcNugget committed Feb 15, 2024
    Configuration menu
    Copy the full SHA
    69b566c View commit details
    Browse the repository at this point in the history

Commits on Feb 28, 2024

  1. Configuration menu
    Copy the full SHA
    6589b86 View commit details
    Browse the repository at this point in the history
  2. Rubocop

    jheysel-r7 committed Feb 28, 2024
    Configuration menu
    Copy the full SHA
    8ce9500 View commit details
    Browse the repository at this point in the history

Commits on Mar 11, 2024

  1. Configuration menu
    Copy the full SHA
    6c1b4c1 View commit details
    Browse the repository at this point in the history
  2. Merge branch 'runc_priv_esc' of github.com:SickMcNugget/metasploit-fr…

    …amework into runc_priv_esc
    SickMcNugget committed Mar 11, 2024
    Configuration menu
    Copy the full SHA
    67fcd57 View commit details
    Browse the repository at this point in the history