File _patchinfo of Package patchinfo.24566

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.24566

<patchinfo incident="24566">
  <issue tracker="bnc" id="1200145">VUL-0: CVE-2022-31030: containerd: denial of service via invocation of the ExecSync API</issue>
  <issue tracker="cve" id="2022-31030"/>
  <issue tracker="bnc" id="1199565">Error calling from Makefile to bash script on s390x</issue>
  <issue tracker="bnc" id="1199460">VUL-0: CVE-2022-29162: runc: incorrect handling of inheritable capabilities in default configuration</issue>
  <issue tracker="bnc" id="1192051">docker and podman block faccessat2 syscall</issue>
  <issue tracker="bnc" id="1200088"/>
  <issue tracker="cve" id="2022-29162"/>
  <packager>cyphar</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for containerd</summary>
  <description>This update for containerd fixes the following issues:

containerd:

- CVE-2022-31030: Fixed denial of service via invocation of the ExecSync API (bsc#1200145)

docker:

- Update to Docker 20.10.17-ce. See upstream changelog online at
  https://docs.docker.com/engine/release-notes/#201017 . bsc#1200145

runc:

Update to runc v1.1.3.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3.

* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
  s390 and s390x. This solves the issue where syscalls the host kernel did not
  support would return `-EPERM` despite the existence of the `-ENOSYS` stub
  code (this was due to how s390x does syscall multiplexing).
* Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
  intended; this fix does not affect runc binary itself but is important for
  libcontainer users such as Kubernetes.
* Inability to compile with recent clang due to an issue with duplicate
  constants in libseccomp-golang.
* When using systemd cgroup driver, skip adding device paths that don't exist,
  to stop systemd from emitting warnings about those paths.
* Socket activation was failing when more than 3 sockets were used.
* Various CI fixes.
* Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
    
- Fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. (bsc#1192051 bsc#1199565)

Update to runc v1.1.2.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2.

Security issue fixed:

- CVE-2022-29162: A bug was found in runc where runc exec --cap executed processes with
  non-empty inheritable Linux process capabilities, creating an atypical Linux
  environment. (bsc#1199460)

- runc spec no longer sets any inheritable capabilities in the created
  example OCI spec (config.json) file.

Update to runc v1.1.1.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1.

* runc run/start can now run a container with read-only /dev in OCI spec,
  rather than error out. (#3355)
* runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
  libcontainer systemd v2 manager no longer errors out if one of the files
  listed in /sys/kernel/cgroup/delegate do not exist in container's
  cgroup. (#3387, #3404)
* Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
  error. (#3406)
* libcontainer/cgroups no longer panics in cgroup v1 managers if stat
  of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)

Update to runc v1.1.0.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0.

- libcontainer will now refuse to build without the nsenter package being
  correctly compiled (specifically this requires CGO to be enabled). This
  should avoid folks accidentally creating broken runc binaries (and
  incorrectly importing our internal libraries into their projects). (#3331)

Update to runc v1.1.0~rc1.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.

+ Add support for RDMA cgroup added in Linux 4.11.
+ runc exec now produces exit code of 255 when the exec failed.
  This may help in distinguishing between runc exec failures
  (such as invalid options, non-running container or non-existent
  binary etc.) and failures of the command being executed.
+ runc run: new --keep option to skip removal exited containers artefacts.
  This might be useful to check the state (e.g. of cgroup controllers) after
  the container has&#65532;exited.
+ seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
  (the latter is just an alias for SCMP_ACT_KILL).
+ seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
  users to create sophisticated seccomp filters where syscalls can be
  efficiently emulated by privileged processes on the host.
+ checkpoint/restore: add an option (--lsm-mount-context) to set
  a different LSM mount context on restore.
+ intelrdt: support ClosID parameter.
+ runc exec --cgroup: an option to specify a (non-top) in-container cgroup
  to use for the process being executed.
+ cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
  machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
  run/exec now adds the container to the appropriate cgroup under it).
+ sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
  behaviour.
+ mounts: add support for bind-mounts which are inaccessible after switching
  the user namespace. Note that this does not permit the container any
  additional access to the host filesystem, it simply allows containers to
  have bind-mounts configured for paths the user can access but have
  restrictive access control settings for other users.
+ Add support for recursive mount attributes using mount_setattr(2). These
  have the same names as the proposed mount(8) options -- just prepend r
  to the option name (such as rro).
+ Add runc features subcommand to allow runc users to detect what features
  runc has been built with. This includes critical information such as
  supported mount flags, hook names, and so on. Note that the output of this
  command is subject to change and will not be considered stable until runc
  1.2 at the earliest. The runtime-spec specification for this feature is
  being developed in opencontainers/runtime-spec#1130.
* system: improve performance of /proc/$pid/stat parsing.
* cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
  the ownership of certain cgroup control files (as per
  /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
  process.
* runc checkpoint/restore: fixed for containers with an external bind mount
  which destination is a symlink.
* cgroup: improve openat2 handling for cgroup directory handle hardening.
  runc delete -f now succeeds (rather than timing out) on a paused
  container.
* runc run/start/exec now refuses a frozen cgroup (paused container in case of
  exec). Users can disable this using --ignore-paused.
</description>
<message>Updating docker will restart the docker service, which may stop some of your docker containers. Do you want to proceed with the update?</message>
</patchinfo>

Places

File _patchinfo of Package patchinfo.24566

Places