Summary
runc
[1:1.1.4-1.0.1]
- rootless: fix /sys/fs/cgroup mounts to prevent CVE-2023-25809
- rootfs: prohibit symlinks that conflicts with readonlyPaths
and/or maskedPaths to prevent CVE-2023-27561
- Prohibit /proc and /sys to be symlinks to prevent CVE-2023-28642
- JIRA: OLDIS-25589
Fixed packages 32
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | aardvark-dns | 2:1.5.0-2.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | buildah | 1:1.29.1-2.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | buildah-tests | 1:1.29.1-2.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | cockpit-podman | 0:63.1-1.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | conmon | 3:2.1.6-1.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | container-selinux | 2:2.205.0-2.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | containernetworking-plugins | 1:1.2.0-1.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | containers-common | 2:1-64.0.1.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | crit | 0:3.15-3.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | criu | 0:3.15-3.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | criu-devel | 0:3.15-3.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | criu-libs | 0:3.15-3.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | crun | 0:1.8.4-2.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | fuse-overlayfs | 0:1.11-1.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | libslirp | 0:4.4.0-1.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | libslirp-devel | 0:4.4.0-1.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | netavark | 2:1.5.0-5.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | oci-seccomp-bpf-hook | 0:1.2.8-1.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | podman | 3:4.4.1-12.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | podman-catatonit | 3:4.4.1-12.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | podman-docker | 3:4.4.1-12.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | podman-gvproxy | 3:4.4.1-12.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | podman-plugins | 3:4.4.1-12.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | podman-remote | 3:4.4.1-12.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | podman-tests | 3:4.4.1-12.module+el8.8.0+21056+d98a0860 |
| Oracle Linux · 8 | python3-criu | 0:3.15-3.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | python3-podman | 0:4.4.1-1.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | runc | 1:1.1.4-1.0.1.module+el8.8.0+21119+51f68ed8 |
| Oracle Linux · 8 | skopeo | 2:1.11.2-0.2.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | skopeo-tests | 2:1.11.2-0.2.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | slirp4netns | 0:1.2.0-2.module+el8.8.0+21045+adcb6a64 |
| Oracle Linux · 8 | udica | 0:0.2.6-20.module+el8.8.0+21045+adcb6a64 |
Vulnerabilities 3
-
High 7.0
Opencontainers runc Incorrect Authorization vulnerability
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom …
-
Medium 6.1
AppArmor bypass with symlinked /proc in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…
-
Medium 5.0
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the…