Summary
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.
Security Fix(es):
* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
* runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)
* runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
* runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration (CVE-2023-28642)
* runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (CVE-2021-43784)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | runc | 4:1.1.9-1.el9 |
Vulnerabilities 6
-
High 7.0
Opencontainers runc Incorrect Authorization vulnerability
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom …
-
Medium 6.1
AppArmor bypass with symlinked /proc in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…
-
Medium 6.0
Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible f…
-
Medium 5.9
opencontainers runc contains procfs race condition with a shared volume mount
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run cus…
-
Medium 5.0
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the…
-
Unscored —
Panic on large handshake records in crypto/tls
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 cli…
References
-
report
https://access.redhat.com/security/cve/CVE-2021-43784
-
report
https://access.redhat.com/security/cve/CVE-2022-41724
-
report
https://access.redhat.com/security/cve/CVE-2023-25809
-
report
https://access.redhat.com/security/cve/CVE-2023-27561
-
report
https://access.redhat.com/security/cve/CVE-2023-28642
-
report
https://bugzilla.redhat.com/2029439
-
report
https://bugzilla.redhat.com/2175721
-
report
https://bugzilla.redhat.com/2178492
-
report
https://bugzilla.redhat.com/2182883
-
report
https://bugzilla.redhat.com/2182884
-
advisory
https://errata.almalinux.org/9/ALSA-2023-6380.html