Security update for containerd, docker, runc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1964-1 Final 1 1 2017-02-06T14:38:53Z current 2017-02-06T14:38:53Z 2017-02-06T14:38:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for containerd, docker, runc This update for - containerd - docker to 1.12.6 - runc fixes the two issues. This security issue was fixed: - CVE-2016-9962: A difficult to exploit race condition caused by passing a file descriptor from the host's filesystem into the container could have allowed the guest to escape(bsc#1012568). For docker this non-security issue was fixed: - bsc#1019251: Waiting when starting the docker service The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-6-2017-201,SUSE-SLE-Module-Containers-12-2017-201 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171964-1/ Link for SUSE-SU-2017:1964-1 https://lists.suse.com/pipermail/sle-security-updates/2017-July/003069.html E-Mail link for SUSE-SU-2017:1964-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1012568 SUSE Bug 1012568 https://bugzilla.suse.com/1019251 SUSE Bug 1019251 https://www.suse.com/security/cve/CVE-2016-9962/ SUSE CVE CVE-2016-9962 page SUSE Linux Enterprise Module for Containers 12 SUSE OpenStack Cloud 6 containerd-0.2.5+gitr569_2a5e70c-15.3 docker-1.12.6-87.2 runc-0.1.1+gitr2819_50a19c6-15.2 containerd-0.2.5+gitr569_2a5e70c-15.3 as a component of SUSE Linux Enterprise Module for Containers 12 docker-1.12.6-87.2 as a component of SUSE Linux Enterprise Module for Containers 12 runc-0.1.1+gitr2819_50a19c6-15.2 as a component of SUSE Linux Enterprise Module for Containers 12 containerd-0.2.5+gitr569_2a5e70c-15.3 as a component of SUSE OpenStack Cloud 6 docker-1.12.6-87.2 as a component of SUSE OpenStack Cloud 6 runc-0.1.1+gitr2819_50a19c6-15.2 as a component of SUSE OpenStack Cloud 6 RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container. CVE-2016-9962 SUSE Linux Enterprise Module for Containers 12:containerd-0.2.5+gitr569_2a5e70c-15.3 SUSE Linux Enterprise Module for Containers 12:docker-1.12.6-87.2 SUSE Linux Enterprise Module for Containers 12:runc-0.1.1+gitr2819_50a19c6-15.2 SUSE OpenStack Cloud 6:containerd-0.2.5+gitr569_2a5e70c-15.3 SUSE OpenStack Cloud 6:docker-1.12.6-87.2 SUSE OpenStack Cloud 6:runc-0.1.1+gitr2819_50a19c6-15.2 moderate 4.1 AV:L/AC:M/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171964-1/ https://www.suse.com/security/cve/CVE-2016-9962.html CVE-2016-9962 https://bugzilla.suse.com/1012568 SUSE Bug 1012568 https://bugzilla.suse.com/1173425 SUSE Bug 1173425