Oval Definition:oval:org.opensuse.security:def:995
Revision Date:2022-06-14Version:1
Title:Security update for containerd, docker and runc (Important) (in QA)
Description:
This update for containerd, docker and runc fixes the following issues:

containerd:

- CVE-2022-31030: Fixed denial of service via invocation of the ExecSync API (bsc#1200145)

docker:

- Update to Docker 20.10.17-ce. See upstream changelog online at
https://docs.docker.com/engine/release-notes/#201017. (bsc#1200145)

runc:

Update to runc v1.1.3.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3.

* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
s390 and s390x. This solves the issue where syscalls the host kernel did not
support would return `-EPERM` despite the existence of the `-ENOSYS` stub
code (this was due to how s390x does syscall multiplexing).
* Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
intended; this fix does not affect runc binary itself but is important for
libcontainer users such as Kubernetes.
* Inability to compile with recent clang due to an issue with duplicate
constants in libseccomp-golang.
* When using systemd cgroup driver, skip adding device paths that don't exist,
to stop systemd from emitting warnings about those paths.
* Socket activation was failing when more than 3 sockets were used.
* Various CI fixes.
* Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
- Fixed issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
that platform's syscall multiplexing semantics. (bsc#1192051 bsc#1199565)

Update to runc v1.1.2.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2.

Security issue fixed:

- CVE-2022-29162: A bug was found in runc where runc exec --cap executed processes with
non-empty inheritable Linux process capabilities, creating an atypical Linux
environment. (bsc#1199460)

- `runc spec` no longer sets any inheritable capabilities in the created
example OCI spec (`config.json`) file.

Update to runc v1.1.1.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1.

* runc run/start can now run a container with read-only /dev in OCI spec,
rather than error out. (#3355)
* runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
libcontainer systemd v2 manager no longer errors out if one of the files
listed in /sys/kernel/cgroup/delegate do not exist in container's
cgroup. (#3387, #3404)
* Loosen OCI spec validation to avoid bogus 'Intel RDT is not supported'
error. (#3406)
* libcontainer/cgroups no longer panics in cgroup v1 managers if stat
of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)

Update to runc v1.1.0.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0.

- libcontainer will now refuse to build without the nsenter package being
correctly compiled (specifically this requires CGO to be enabled). This
should avoid folks accidentally creating broken runc binaries (and
incorrectly importing our internal libraries into their projects). (#3331)

Update to runc v1.1.0~rc1.

Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.

+ Add support for RDMA cgroup added in Linux 4.11.
* runc exec now produces exit code of 255 when the exec failed.
This may help in distinguishing between runc exec failures
(such as invalid options, non-running container or non-existent
binary etc.) and failures of the command being executed.
+ runc run: new --keep option to skip removal exited containers artefacts.
This might be useful to check the state (e.g. of cgroup controllers) after
the container hasexited.
+ seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
(the latter is just an alias for SCMP_ACT_KILL).
+ seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
users to create sophisticated seccomp filters where syscalls can be
efficiently emulated by privileged processes on the host.
+ checkpoint/restore: add an option (--lsm-mount-context) to set
a different LSM mount context on restore.
+ intelrdt: support ClosID parameter.
+ runc exec --cgroup: an option to specify a (non-top) in-container cgroup
to use for the process being executed.
+ cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
run/exec now adds the container to the appropriate cgroup under it).
+ sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
behaviour.
+ mounts: add support for bind-mounts which are inaccessible after switching
the user namespace. Note that this does not permit the container any
additional access to the host filesystem, it simply allows containers to
have bind-mounts configured for paths the user can access but have
restrictive access control settings for other users.
+ Add support for recursive mount attributes using mount_setattr(2). These
have the same names as the proposed mount(8) options -- just prepend r
to the option name (such as rro).
+ Add runc features subcommand to allow runc users to detect what features
runc has been built with. This includes critical information such as
supported mount flags, hook names, and so on. Note that the output of this
command is subject to change and will not be considered stable until runc
1.2 at the earliest. The runtime-spec specification for this feature is
being developed in opencontainers/runtime-spec#1130.
* system: improve performance of /proc/$pid/stat parsing.
* cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
the ownership of certain cgroup control files (as per
/sys/kernel/cgroup/delegate) to allow for proper deferral to the container
process.
* runc checkpoint/restore: fixed for containers with an external bind mount
which destination is a symlink.
* cgroup: improve openat2 handling for cgroup directory handle hardening.
runc delete -f now succeeds (rather than timing out) on a paused
container.
* runc run/start/exec now refuses a frozen cgroup (paused container in case of
exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of the release.

This patch is currently in QA and not yet available for download.
Family:unixClass:patch
Status:Reference(s):1192051
1199460
1199565
1200088
1200145
CVE-2005-4900
CVE-2014-9390
CVE-2016-2315
CVE-2016-2324
CVE-2016-9957
CVE-2016-9958
CVE-2016-9959
CVE-2016-9960
CVE-2016-9961
CVE-2017-1000117
CVE-2017-14867
CVE-2017-15298
CVE-2017-8386
CVE-2018-1000140
CVE-2018-1000140
CVE-2018-11233
CVE-2018-11235
CVE-2018-17456
CVE-2018-19486
CVE-2019-1348
CVE-2019-1349
CVE-2019-1350
CVE-2019-1351
CVE-2019-1352
CVE-2019-1353
CVE-2019-1354
CVE-2019-1387
CVE-2019-19604
CVE-2020-11008
CVE-2020-5260
CVE-2021-21300
CVE-2022-29162
CVE-2022-31030
Platform(s):openSUSE 13.2
SUSE Cloud Compute Node for SUSE Linux Enterprise 12 5
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Desktop 12 SP1
SUSE Linux Enterprise Desktop 12 SP3
SUSE Linux Enterprise Desktop 15 SP3
SUSE Linux Enterprise High Availability 15
SUSE Linux Enterprise High Performance Computing 15 SP3
SUSE Linux Enterprise Module for additional PackageHub packages 15
SUSE Linux Enterprise Module for Basesystem 15 SP3
SUSE Linux Enterprise Module for Containers 15 SP3
SUSE Linux Enterprise Module for Desktop Applications 15
SUSE Linux Enterprise Module for High Performance Computing 15
SUSE Linux Enterprise Module for Legacy Software 15
SUSE Linux Enterprise Module for Live Patching 15
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
SUSE Linux Enterprise Module for Server Applications 15
SUSE Linux Enterprise Module for Web Scripting 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 12 SP1
SUSE Linux Enterprise Server 12 SP2
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15 SP3
SUSE Linux Enterprise Software Development Kit 11 SP2
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Storage 7.1
SUSE Linux Enterprise Workstation Extension 12
SUSE Linux Enterprise Workstation Extension 12 SP1
SUSE Linux Enterprise Workstation Extension 15
SUSE Manager Proxy 4.2
SUSE Manager Retail Branch Server 4.2
SUSE Manager Server 4.2
SUSE Package Hub for SUSE Linux Enterprise 12
SUSE Package Hub for SUSE Linux Enterprise 15
Product(s):
Definition Synopsis
  • SUSE Cloud Compute Node for SUSE Linux Enterprise 12 5 is installed
  • AND Package Information
  • openstack-cinder-2014.2.3.dev13-1 is installed
  • OR openstack-cinder-volume-2014.2.3.dev13-1 is installed
  • OR python-cinder-2014.2.3.dev13-1 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 is installed
  • AND argyllcms-1.6.3-1 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP1 is installed
  • AND Package Information
  • avahi-0.6.31-20 is installed
  • OR avahi-lang-0.6.31-20 is installed
  • OR libavahi-client3-0.6.31-20 is installed
  • OR libavahi-client3-32bit-0.6.31-20 is installed
  • OR libavahi-common3-0.6.31-20 is installed
  • OR libavahi-common3-32bit-0.6.31-20 is installed
  • OR libavahi-core7-0.6.31-20 is installed
  • OR libdns_sd-0.6.31-20 is installed
  • OR libdns_sd-32bit-0.6.31-20 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP3 is installed
  • AND libopus0-1.1-3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Basesystem 15 SP3 is installed
  • AND git-core-2.26.2-3.31.1 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise High Availability 15 is installed
  • AND Package Information
  • ruby2.5-rubygem-sprockets-3.7.2-3.3 is installed
  • OR rubygem-sprockets-3.7.2-3.3 is installed
    • Definition Synopsis
  • Release Information
  • SUSE Linux Enterprise High Performance Computing 15 SP3 is installed
  • OR SUSE Linux Enterprise Module for Containers 15 SP3 is installed
  • OR SUSE Linux Enterprise Server 15 SP3 is installed
  • OR SUSE Linux Enterprise Server for SAP Applications 15 SP3 is installed
  • OR SUSE Linux Enterprise Storage 7.1 is installed
  • OR SUSE Manager Proxy 4.2 is installed
  • OR SUSE Manager Retail Branch Server 4.2 is installed
  • OR SUSE Manager Server 4.2 is installed
  • AND Package Information
  • containerd-1.6.6-150000.73.2 is installed
  • OR containerd-ctr-1.6.6-150000.73.2 is installed
  • OR docker-20.10.17_ce-150000.166.1 is installed
  • OR docker-bash-completion-20.10.17_ce-150000.166.1 is installed
  • OR docker-fish-completion-20.10.17_ce-150000.166.1 is installed
  • OR runc-1.1.3-150000.30.1 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for additional PackageHub packages 15 is installed
  • AND Package Information
  • postgresql10-10.6-4.8 is installed
  • OR postgresql10-test-10.6-4.8 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Desktop Applications 15 is installed
  • AND Package Information
  • libgme-devel-0.6.2-1 is installed
  • OR libgme0-0.6.2-1 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for High Performance Computing 15 is installed
  • AND Package Information
  • python-numpy_1_14_0-gnu-hpc-1.14.0-4.5 is installed
  • OR python2-numpy-gnu-hpc-1.14.0-4.5 is installed
  • OR python2-numpy-gnu-hpc-devel-1.14.0-4.5 is installed
  • OR python2-numpy_1_14_0-gnu-hpc-1.14.0-4.5 is installed
  • OR python2-numpy_1_14_0-gnu-hpc-devel-1.14.0-4.5 is installed
  • OR python3-numpy-gnu-hpc-1.14.0-4.5 is installed
  • OR python3-numpy-gnu-hpc-devel-1.14.0-4.5 is installed
  • OR python3-numpy_1_14_0-gnu-hpc-1.14.0-4.5 is installed
  • OR python3-numpy_1_14_0-gnu-hpc-devel-1.14.0-4.5 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Legacy Software 15 is installed
  • AND Package Information
  • java-1_8_0-openjdk-1.8.0.171-3.3 is installed
  • OR java-1_8_0-openjdk-demo-1.8.0.171-3.3 is installed
  • OR java-1_8_0-openjdk-devel-1.8.0.171-3.3 is installed
  • OR java-1_8_0-openjdk-headless-1.8.0.171-3.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Live Patching 15 is installed
  • AND Package Information
  • kernel-default-4.12.14-25.6 is installed
  • OR kernel-default-livepatch-4.12.14-25.6 is installed
  • OR kernel-livepatch-4_12_14-25_6-default-1-1.3 is installed
  • OR kernel-livepatch-SLE15_Update_2-1-1.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 is installed
  • AND Package Information
  • go1.11-1.11.5-1.9 is installed
  • OR go1.11-doc-1.11.5-1.9 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Server Applications 15 is installed
  • AND Package Information
  • librelp-devel-1.2.15-1 is installed
  • OR librelp0-1.2.15-1 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Web Scripting 15 is installed
  • AND Package Information
  • apache2-mod_php7-7.2.5-4.3 is installed
  • OR php7-7.2.5-4.3 is installed
  • OR php7-bcmath-7.2.5-4.3 is installed
  • OR php7-bz2-7.2.5-4.3 is installed
  • OR php7-calendar-7.2.5-4.3 is installed
  • OR php7-ctype-7.2.5-4.3 is installed
  • OR php7-curl-7.2.5-4.3 is installed
  • OR php7-dba-7.2.5-4.3 is installed
  • OR php7-devel-7.2.5-4.3 is installed
  • OR php7-dom-7.2.5-4.3 is installed
  • OR php7-enchant-7.2.5-4.3 is installed
  • OR php7-exif-7.2.5-4.3 is installed
  • OR php7-fastcgi-7.2.5-4.3 is installed
  • OR php7-fileinfo-7.2.5-4.3 is installed
  • OR php7-fpm-7.2.5-4.3 is installed
  • OR php7-ftp-7.2.5-4.3 is installed
  • OR php7-gd-7.2.5-4.3 is installed
  • OR php7-gettext-7.2.5-4.3 is installed
  • OR php7-gmp-7.2.5-4.3 is installed
  • OR php7-iconv-7.2.5-4.3 is installed
  • OR php7-intl-7.2.5-4.3 is installed
  • OR php7-json-7.2.5-4.3 is installed
  • OR php7-ldap-7.2.5-4.3 is installed
  • OR php7-mbstring-7.2.5-4.3 is installed
  • OR php7-mysql-7.2.5-4.3 is installed
  • OR php7-odbc-7.2.5-4.3 is installed
  • OR php7-opcache-7.2.5-4.3 is installed
  • OR php7-openssl-7.2.5-4.3 is installed
  • OR php7-pcntl-7.2.5-4.3 is installed
  • OR php7-pdo-7.2.5-4.3 is installed
  • OR php7-pear-7.2.5-4.3 is installed
  • OR php7-pear-Archive_Tar-7.2.5-4.3 is installed
  • OR php7-pgsql-7.2.5-4.3 is installed
  • OR php7-phar-7.2.5-4.3 is installed
  • OR php7-posix-7.2.5-4.3 is installed
  • OR php7-shmop-7.2.5-4.3 is installed
  • OR php7-snmp-7.2.5-4.3 is installed
  • OR php7-soap-7.2.5-4.3 is installed
  • OR php7-sockets-7.2.5-4.3 is installed
  • OR php7-sqlite-7.2.5-4.3 is installed
  • OR php7-sysvmsg-7.2.5-4.3 is installed
  • OR php7-sysvsem-7.2.5-4.3 is installed
  • OR php7-sysvshm-7.2.5-4.3 is installed
  • OR php7-tokenizer-7.2.5-4.3 is installed
  • OR php7-wddx-7.2.5-4.3 is installed
  • OR php7-xmlreader-7.2.5-4.3 is installed
  • OR php7-xmlrpc-7.2.5-4.3 is installed
  • OR php7-xmlwriter-7.2.5-4.3 is installed
  • OR php7-xsl-7.2.5-4.3 is installed
  • OR php7-zip-7.2.5-4.3 is installed
  • OR php7-zlib-7.2.5-4.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 is installed
  • AND perl-HTML-Parser-3.71-1.178 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2 is installed
  • AND Package Information
  • libsystemd0-228-117.12 is installed
  • OR libsystemd0-32bit-228-117.12 is installed
  • OR libudev1-228-117.12 is installed
  • OR libudev1-32bit-228-117.12 is installed
  • OR systemd-228-117.12 is installed
  • OR systemd-32bit-228-117.12 is installed
  • OR systemd-bash-completion-228-117.12 is installed
  • OR systemd-sysvinit-228-117.12 is installed
  • OR udev-228-117.12 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Workstation Extension 15 is installed
  • AND Package Information
  • MozillaThunderbird-52.9.1-3.7 is installed
  • OR MozillaThunderbird-devel-52.9.1-3.7 is installed
  • OR MozillaThunderbird-translations-common-52.9.1-3.7 is installed
  • OR MozillaThunderbird-translations-other-52.9.1-3.7 is installed
    • Definition Synopsis
  • SUSE Package Hub for SUSE Linux Enterprise 12 is installed
  • AND Package Information
  • chromedriver-53.0.2785.89-96 is installed
  • OR chromium-53.0.2785.89-96 is installed
  • OR chromium-desktop-gnome-53.0.2785.89-96 is installed
  • OR chromium-desktop-kde-53.0.2785.89-96 is installed
  • OR chromium-ffmpegsumo-53.0.2785.89-96 is installed
    • Definition Synopsis
  • SUSE Package Hub for SUSE Linux Enterprise 15 is installed
  • AND Package Information
  • GraphicsMagick-1.3.29-bp150.2.6 is installed
  • OR GraphicsMagick-devel-1.3.29-bp150.2.6 is installed
  • OR libGraphicsMagick++-Q16-12-1.3.29-bp150.2.6 is installed
  • OR libGraphicsMagick++-devel-1.3.29-bp150.2.6 is installed
  • OR libGraphicsMagick-Q16-3-1.3.29-bp150.2.6 is installed
  • OR libGraphicsMagick3-config-1.3.29-bp150.2.6 is installed
  • OR libGraphicsMagickWand-Q16-2-1.3.29-bp150.2.6 is installed
  • OR perl-GraphicsMagick-1.3.29-bp150.2.6 is installed
    • BACK