Summary
runc
[1:1.1.4-1.0.1]
- rootless: fix /sys/fs/cgroup mounts to prevent CVE-2023-25809
- rootfs: prohibit symlinks that conflicts with readonlyPaths
and/or maskedPaths to prevent CVE-2023-27561
- Prohibit /proc and /sys to be symlinks to prevent CVE-2023-28642
- JIRA: OLDIS-25589
Fixed packages 32
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | aardvark-dns | 2:1.0.1-37.0.1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | buildah | 1:1.24.6-5.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | buildah-tests | 1:1.24.6-5.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | cockpit-podman | 0:46-1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | conmon | 2:2.1.4-1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | container-selinux | 2:2.199.0-1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | containernetworking-plugins | 1:1.1.1-2.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | containers-common | 2:1-37.0.1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | crit | 0:3.15-3.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | criu | 0:3.15-3.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | criu-devel | 0:3.15-3.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | criu-libs | 0:3.15-3.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | crun | 0:1.6-1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | fuse-overlayfs | 0:1.9-1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | libslirp | 0:4.4.0-1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | libslirp-devel | 0:4.4.0-1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | netavark | 2:1.0.1-37.0.1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | oci-seccomp-bpf-hook | 0:1.2.5-2.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | podman | 2:4.0.2-20.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | podman-catatonit | 2:4.0.2-20.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | podman-docker | 2:4.0.2-20.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | podman-gvproxy | 2:4.0.2-20.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | podman-plugins | 2:4.0.2-20.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | podman-remote | 2:4.0.2-20.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | podman-tests | 2:4.0.2-20.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | python3-criu | 0:3.15-3.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | python3-podman | 0:4.0.0-1.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | runc | 1:1.1.4-1.0.1.module+el8.8.0+21118+db7590d7 |
| Oracle Linux · 8 | skopeo | 2:1.6.2-6.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | skopeo-tests | 2:1.6.2-6.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | slirp4netns | 0:1.1.8-2.module+el8.8.0+20984+ab6ce66c |
| Oracle Linux · 8 | udica | 0:0.2.6-3.module+el8.8.0+20984+ab6ce66c |
Vulnerabilities 3
-
High 7.0
Opencontainers runc Incorrect Authorization vulnerability
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom …
-
Medium 6.1
AppArmor bypass with symlinked /proc in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…
-
Medium 5.0
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the…