Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21265-1

Опубликовано: 06 июл. 2026
Источник: suse-cvrf

Описание

Security update for cadvisor

This update for cadvisor fixes the following issues:

Changes in cadvisor:

  • update to 0.60.3:

    • Move OOM watching out of the lib module into the binary
    • lib/model: make ContainerStats sub-stats pointers to convey collection presence

  • update to 0.60.1:

    • cpuload/netlink: report the real error and skip the reader on cgroup v2
    • deploy: add lib/go.mod to the image build's dependency cache

  • update to 0.60.0:

    • Exposing additional cgroup v2 memory.stat metrics
    • lib: introduce github.com/google/cadvisor/lib — a lean, kubelet-focused library module

  • bump x/net to 0.55 (bsc#1266645, CVE-2026-39821)

  • update to 0.57.0 (bsc#1260305, CVE-2026-33186):

    • integration: add more Docker container handler tests
    • integration: add containerd container handler tests
    • integration: add Prometheus metrics endpoint tests
    • fix: support podman volatile-containers.json and/or containers.json
    • proposed roadmap for cAdvisor
    • remove log message when you can't read productName
    • Refactor Github Action per b/485167538
    • fix crio deadlock in getting crio sandbox containers
    • Add container_creation_time_seconds (previously: container_start_time_seconds); use runtime start time for container_start_time_seconds (podman & docker)
    • deps: github.com/moby/moby/client v0.4.0, moby/api v1.54.1, containerd/ttrpc v1.2.8
    • fix(build): update k8s-staging-test-infra image in integ tests
    • feat(manager/container): add configurable initial splay and max jitter factors
    • feat(manager): add constraint data in OOM events
    • fix: add v-prefixed GHCR image tags for release consistency
    • build(deps): bump the go_modules group across 2 directories with 1 update
    • Expose cgroup v2 memory.events as Prometheus metrics
    • deploy: bump base images to Alpine 3.23

  • Update to version 0.56.2:

    • docker: fix nil pointer dereference when GraphDriver is nil
    • Update healthcheck.sh
    • Update entrypoint.sh
    • docker: migrate to github.com/moby/moby modules
    • Update containerd, docker, moby, and opencontainers dependencies
    • update README
    • Update copyright year in healthcheck.sh
    • Update copyright year in entrypoint.sh
    • Added cadvisor boilerplate header to deploy/entrypoint.sh
    • Added cadvisor boilerplate header to deploy/healthcheck.sh
    • Add EXPOSE 8080 to document default port
    • Fix healthcheck to respect custom port flag
    • Add entrypoint wrapper to preserve -logtostderr flag
    • add std in summary
    • fix formatting
    • Update container/docker/factory.go
    • Update factory.go
    • Update factory.go
    • Update factory.go
    • Fix for issue #3772
    • docs: replace references to docker registry gcr.io with ghcr.io
    • Expose s390x CPU Topology to Prometheus

  • update to 0.55.1:

    • manager: fix race condition in Stop() using sync.Once
    • manager: fix race condition in Stop() using sync.Once

  • update to 0.55.0:

    • Reduce lock contention in manager package
    • container/podman: fix zfsFilesystem and zfsParent being swapped.
    • devicemapper: use atomic.Value for lock-free cache reads
    • Reduce lock contention in cache/memory package
    • zfs: use atomic.Value for lock-free cache reads
    • fix: docker health check status not updating
    • align docker and podman implementations
    • disable CGO for fully static binaries
    • close stale PRs and Issues
    • refactor(container): Migrate to std lib context package
    • add workflow_dispatch to stale github action
    • plugin factory: remove useless RegisterPlugin log output
    • feat(summary): add count in percentiles
    • machine: fixes for unix.Uname use
    • feat: add LoadTaskProcess api in containerd client
    • feat: add exit code in container deletion events
    • feat: add CRI-O integration tests
    • test: reorganize integration tests and add CRI-O test coverage
    • refactor: remove duplicate tests from api package and add missing CRI-O tests
    • fix: update golang.org/x/crypto to v0.45.0 to fix security vulnerabilities
    • container/(docker|podman): rewrite obtaining IP-address
    • Upgrade GitHub Actions to latest versions
    • Upgrade GitHub Actions for Node 24 compatibility
    • feat: add fs io cost metrics
    • go.mod: github.com/docker/go-connections v0.6.0
    • fs: introduce pluggable filesystem architecture
    • Apply build tags liberally for supported environments (linux)
    • Replace godirwalk with os.ReadDir from standard library
    • feat: add cpu burst metrics

  • update to 0.54.1:

    • chore: update cAdvisor image registry and version in DaemonSet
    • ci: update Ubuntu version to 24.04 in GitHub Actions workflows
    • chore: re-enable golangci-lint checks and fix violations
    • container/docker: GetStats: prevent nil-pointer

  • update to 0.54.0:

    • Let us try to use ghcr.io for container images
    • Add a GH action to create release binaries
    • use qemu/docker to build arch specific binaries
    • add -buildvcs=false to GH action
    • fix(3643) add containerd-snapshotter support
    • Update README.md with latest Docker image version and registry
    • Rebase to alpine 3.22, install thin-provisioning-tools from main repo
    • feat: add metric for container health check status (DOCKER- Specific!)
    • Update golang and deps

  • update to version 0.54.1:

    • container/docker: GetStats: prevent nil-pointer
    • chore: re-enable golangci-lint checks and fix violations
    • fix: use Docker-embedded containerd socket in integration tests
    • refactor: remove Mesos container support
    • ci: add diagnostic logging for docker/containerd debugging
    • fix: persist containerd client error to prevent nil pointer dereference
    • ci: update Ubuntu version to 24.04 in GitHub Actions workflows
    • chore: update cAdvisor image registry and version in DaemonSet
    • fix: handle nil Health state in docker container handler
    • ci: update Go version to 1.25 in GitHub Actions workflows
    • fix: update dependencies to address security vulnerabilities
    • add health status tests
    • feat: Update docker container handler to include health status in stats
    • Rebase to alpine 3.22, install thin-provisioning-tools from main repo
    • Update README.md Docker image reference
    • fix(3643) add containerd-snapshotter support
    • add -buildvcs=false to GH action
    • use qemu/docker to build arch specific binaries
    • Add a GH action to create release binaries
    • Let us try to use ghcr.io for container images (#3699)

  • update to 0.53.0 (bsc#1257429, CVE-2024-45310, bsc#1267788, CVE-2026-10722):

    • fix potential hang on containerd client.LoadContainer
    • Bump dependencies to latest (June 2, 2025)
    • fix: fix call Errorf with wrong err
    • Fixed possible data race
    • Use built-in error wrapping instead of pkg/errors

  • update to 0.52.1:

    • Make resctrl optional/pluggable

  • update to 0.52.0:

    • bump containerd related deps: api v1.8.0; errdefs v1.0.0; ttrpc v1.2.6
    • chore: Update Prometheus libraries
    • ci: golangci-lint bump, fixes, and cleanups
    • bump runc to v1.2.4
    • Add Pressure Stall Information Metrics
    • Switch to opencontainers/cgroups repository (includes update from golang 1.22 to 1.24)
    • Bump to newer opencontainers/image-spec @ v1.1.1

  • update to 0.49.2:

    • Cp fix test
    • Revert "reduce_logs_for_kubelet_use_crio"

Список пакетов

openSUSE Leap 16.0
cadvisor-0.60.3-bp160.1.1

Ссылки

Описание

runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3. Some workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual user on the host (such as with rootless containers that don't use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested.

Затронутые продукты
openSUSE Leap 16.0:cadvisor-0.60.3-bp160.1.1
Ссылки

Описание

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Затронутые продукты
openSUSE Leap 16.0:cadvisor-0.60.3-bp160.1.1
Ссылки

Описание

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Затронутые продукты
openSUSE Leap 16.0:cadvisor-0.60.3-bp160.1.1
Ссылки

Описание

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Затронутые продукты
openSUSE Leap 16.0:cadvisor-0.60.3-bp160.1.1
Ссылки

Описание

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Затронутые продукты
openSUSE Leap 16.0:cadvisor-0.60.3-bp160.1.1
Ссылки