Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:1726-1

Опубликовано: 03 апр. 2023
Источник: suse-cvrf

Описание

Security update for runc

This update for runc fixes the following issues:

Update to runc v1.1.5:

Security fixes:

  • CVE-2023-25809: Fixed rootless /sys/fs/cgroup is writable when cgroupns isn't unshared (bnc#1209884).
  • CVE-2023-27561: Fixed regression that reintroduced CVE-2019-19921 vulnerability (bnc#1208962).
  • CVE-2023-28642: Fixed AppArmor/SELinux bypass with symlinked /proc (bnc#1209888).

Other fixes:

  • Fix the inability to use /dev/null when inside a container.
  • Fix changing the ownership of host's /dev/null caused by fd redirection (bsc#1168481).
  • Fix rare runc exec/enter unshare error on older kernels.
  • nsexec: Check for errors in write_log().
  • Drop version-specific Go requirement.

Список пакетов

Image SLES12-SP5-Azure-Basic-On-Demand
runc-1.1.5-16.29.1
Image SLES12-SP5-Azure-Standard-On-Demand
runc-1.1.5-16.29.1
Image SLES12-SP5-EC2-ECS-On-Demand
runc-1.1.5-16.29.1
Image SLES12-SP5-EC2-On-Demand
runc-1.1.5-16.29.1
Image SLES12-SP5-GCE-On-Demand
runc-1.1.5-16.29.1
SUSE Linux Enterprise Module for Containers 12
runc-1.1.5-16.29.1

Ссылки

Описание

runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.

Затронутые продукты
Image SLES12-SP5-Azure-Basic-On-Demand:runc-1.1.5-16.29.1
Image SLES12-SP5-Azure-Standard-On-Demand:runc-1.1.5-16.29.1
Image SLES12-SP5-EC2-ECS-On-Demand:runc-1.1.5-16.29.1
Image SLES12-SP5-EC2-On-Demand:runc-1.1.5-16.29.1
Ссылки

Описание

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

Затронутые продукты
Image SLES12-SP5-Azure-Basic-On-Demand:runc-1.1.5-16.29.1
Image SLES12-SP5-Azure-Standard-On-Demand:runc-1.1.5-16.29.1
Image SLES12-SP5-EC2-ECS-On-Demand:runc-1.1.5-16.29.1
Image SLES12-SP5-EC2-On-Demand:runc-1.1.5-16.29.1
Ссылки

Описание

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

Затронутые продукты
Image SLES12-SP5-Azure-Basic-On-Demand:runc-1.1.5-16.29.1
Image SLES12-SP5-Azure-Standard-On-Demand:runc-1.1.5-16.29.1
Image SLES12-SP5-EC2-ECS-On-Demand:runc-1.1.5-16.29.1
Image SLES12-SP5-EC2-On-Demand:runc-1.1.5-16.29.1
Ссылки