Summary
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
* runc: file descriptor leak (CVE-2024-21626)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 34
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | aardvark-dns | 2:1.7.0-1.module_el8.9.0+3657+d86e192f |
| AlmaLinux · 8 | buildah | 1:1.31.3-3.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | buildah-tests | 1:1.31.3-3.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | cockpit-podman | 75-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | conmon | 3:2.1.8-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | container-selinux | 2:2.221.0-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | containernetworking-plugins | 1:1.3.0-8.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | containers-common | 2:1-71.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | crit | 3.18-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | criu | 3.18-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | criu-devel | 3.18-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | criu-libs | 3.18-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | crun | 1.8.7-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | fuse-overlayfs | 1.12-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | libslirp | 4.4.0-1.module_el8.8.0+3615+3543c705 |
| AlmaLinux · 8 | libslirp-devel | 4.4.0-1.module_el8.8.0+3615+3543c705 |
| AlmaLinux · 8 | netavark | 2:1.7.0-2.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | oci-seccomp-bpf-hook | 1.2.9-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | podman | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | podman-catatonit | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | podman-docker | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | podman-gvproxy | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | podman-plugins | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | podman-remote | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | podman-tests | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | python3-criu | 3.18-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | python3-podman | 4.6.0-2.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | runc | 1:1.1.12-1.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | skopeo | 2:1.13.3-3.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | skopeo-tests | 2:1.13.3-3.module_el8.9.0+3717+81096349 |
| AlmaLinux · 8 | slirp4netns | 1.2.1-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | toolbox | 0.0.99.4-5.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | toolbox-tests | 0.0.99.4-5.module_el8.9.0+3643+9234dc3b |
| AlmaLinux · 8 | udica | 0.2.6-20.module_el8.8.0+3615+3543c705 |
Vulnerabilities 1
-
High 8.6
runc container breakout through process.cwd trickery and leaked fds
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a worki…