Security update for runc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:1726-1 Final 1 1 2023-04-03T08:24:06Z current 2023-04-03T08:24:06Z 2023-04-03T08:24:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for runc This update for runc fixes the following issues: Update to runc v1.1.5: Security fixes: - CVE-2023-25809: Fixed rootless `/sys/fs/cgroup` is writable when cgroupns isn't unshared (bnc#1209884). - CVE-2023-27561: Fixed regression that reintroduced CVE-2019-19921 vulnerability (bnc#1208962). - CVE-2023-28642: Fixed AppArmor/SELinux bypass with symlinked /proc (bnc#1209888). Other fixes: - Fix the inability to use `/dev/null` when inside a container. - Fix changing the ownership of host's `/dev/null` caused by fd redirection (bsc#1168481). - Fix rare runc exec/enter unshare error on older kernels. - nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-Basic-On-Demand-2023-1726,Image SLES12-SP5-Azure-Standard-On-Demand-2023-1726,Image SLES12-SP5-EC2-ECS-On-Demand-2023-1726,Image SLES12-SP5-EC2-On-Demand-2023-1726,Image SLES12-SP5-GCE-On-Demand-2023-1726,SUSE-2023-1726,SUSE-SLE-Module-Containers-12-2023-1726 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20231726-1/ Link for SUSE-SU-2023:1726-1 https://lists.suse.com/pipermail/sle-updates/2023-April/028593.html E-Mail link for SUSE-SU-2023:1726-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1168481 SUSE Bug 1168481 https://bugzilla.suse.com/1208962 SUSE Bug 1208962 https://bugzilla.suse.com/1209884 SUSE Bug 1209884 https://bugzilla.suse.com/1209888 SUSE Bug 1209888 https://www.suse.com/security/cve/CVE-2023-25809/ SUSE CVE CVE-2023-25809 page https://www.suse.com/security/cve/CVE-2023-27561/ SUSE CVE CVE-2023-27561 page https://www.suse.com/security/cve/CVE-2023-28642/ SUSE CVE CVE-2023-28642 page Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-On-Demand SUSE Linux Enterprise Module for Containers 12 runc-1.1.5-16.29.1 runc-1.1.5-16.29.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand runc-1.1.5-16.29.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand runc-1.1.5-16.29.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand runc-1.1.5-16.29.1 as a component of Image SLES12-SP5-EC2-On-Demand runc-1.1.5-16.29.1 as a component of Image SLES12-SP5-GCE-On-Demand runc-1.1.5-16.29.1 as a component of SUSE Linux Enterprise Module for Containers 12 runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. CVE-2023-25809 Image SLES12-SP5-Azure-Basic-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-Azure-Standard-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-EC2-ECS-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-EC2-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-GCE-On-Demand:runc-1.1.5-16.29.1 SUSE Linux Enterprise Module for Containers 12:runc-1.1.5-16.29.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231726-1/ https://www.suse.com/security/cve/CVE-2023-25809.html CVE-2023-25809 https://bugzilla.suse.com/1209884 SUSE Bug 1209884 runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression. CVE-2023-27561 Image SLES12-SP5-Azure-Basic-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-Azure-Standard-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-EC2-ECS-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-EC2-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-GCE-On-Demand:runc-1.1.5-16.29.1 SUSE Linux Enterprise Module for Containers 12:runc-1.1.5-16.29.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231726-1/ https://www.suse.com/security/cve/CVE-2023-27561.html CVE-2023-27561 https://bugzilla.suse.com/1208962 SUSE Bug 1208962 runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image. CVE-2023-28642 Image SLES12-SP5-Azure-Basic-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-Azure-Standard-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-EC2-ECS-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-EC2-On-Demand:runc-1.1.5-16.29.1 Image SLES12-SP5-GCE-On-Demand:runc-1.1.5-16.29.1 SUSE Linux Enterprise Module for Containers 12:runc-1.1.5-16.29.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231726-1/ https://www.suse.com/security/cve/CVE-2023-28642.html CVE-2023-28642 https://bugzilla.suse.com/1209888 SUSE Bug 1209888