CVE-2019-5736 fix for Azure IoT Edge
Share
Services
Recently, a security vulnerability ([CVE-2019-5736](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5736 "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5736")) was announced in runC, the low-level container runtime that supports Docker and associated container engines. The vulnerability allows a malicious container to escalate privileges on the host machine when a user runs the exec command to execute an operation in a running instance of that container.
Microsoft has built a new version of the Moby container runtime (v3.0.4) that includes the Open Container Initiative (OCI) update to address this vulnerability. We highly recommend that you update the container runtime on your IoT Edge device by using the following instructions, as applicable:
Linux Debian-based X64 (.deb):
1. Follow the [instructions ](https://docs.microsoft.com/en-us/azure/iot-edge/how-to-install-iot-edge-linux#register-microsoft-key-and-software-repository-feed "https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fiot-edge%2Fhow-to-install-iot-edge-linux%23register-microsoft-key-and-software-repository-feed&data=02%7C01%7Cveyalla%40microsoft.com%7C6070c4ef04254d92")to register to Microsoft key and software repository feed.
2. sudo apt-get update
3. sudo apt-get install moby-engine
Linux CentOS-based X64 (.rpm):
1. curl -L https://aka.ms/moby-engine-x86\_64-rpm-latest -o moby-engine-3.0.4-centos.x86\_64.rpm
2. sudo yum install -y ./moby-engine-3.0.4-centos.x86\_64.rpm
Linux Debian-based ARM32 (for example, Raspberry Pi):
1. curl -L https://aka.ms/moby-engine-armhf-latest -o moby\_engine.deb
2. sudo dpkg -i ./moby\_engine.deb
Please update [Docker Engine (18.09.2 or more recent) ](https://docs.docker.com/engine/release-notes/#18092)if you’re testing or developing with Docker instead of the Microsoft-built moby-engine.
Windows containers on Windows are not affected.
* Azure IoT Edge
* Security
* [ Azure IoT Edge](https://azure.microsoft.com/en-gb/products/iot-edge/)
What else is happening at Microsoft Azure?
Read update
Services
Share
Read update
Services
Share
We’re retiring Azure Time Series Insights on 7 July 2024 – transition to Azure Data Explorer
May 31st, 2024
Services
Share