deps: update module github.com/containerd/containerd to v1.7.11 [security] #550
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
added
the
kind/security
github-actions
bot
added
the
size/S
renovate
bot
force-pushed
the
renovate/go-github.com/containerd/containerd-vulnerability
branch
from
864dc8d
to
06cef2a
Compare
ckotzbauer
deleted the
renovate/go-github.com/containerd/containerd-vulnerability
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.7.8->v1.7.11GitHub Vulnerability Alerts
GHSA-7ww5-4wqc-m92c
/sys/devices/virtual/powercap accessible by default to containers
Intel's RAPL (Running Average Power Limit) feature, introduced by the Sandy Bridge microarchitecture, provides software insights into hardware energy consumption. To facilitate this, Intel introduced the powercap framework in Linux kernel 3.13, which reads values via relevant MSRs (model specific registers) and provides unprivileged userspace access via
sysfs. As RAPL is an interface to access a hardware feature, it is only available when running on bare metal with the module compiled into the kernel.By 2019, it was realized that in some cases unprivileged access to RAPL readings could be exploited as a power-based side-channel against security features including AES-NI (potentially inside a SGX enclave) and KASLR (kernel address space layout randomization). Also known as the PLATYPUS attack, Intel assigned CVE-2020-8694 and CVE-2020-8695, and AMD assigned CVE-2020-12912.
Several mitigations were applied; Intel reduced the sampling resolution via a microcode update, and the Linux kernel prevents access by non-root users since 5.10. However, this kernel-based mitigation does not apply to many container-based scenarios:
sysfsis mounted inside containers read-only; however only read access is needed to carry out this attack on an unpatched CPUWhile this is not a direct vulnerability in container runtimes, defense in depth and safe defaults are valuable and preferred, especially as this poses a risk to multi-tenant container environments. This is provided by masking
/sys/devices/virtual/powercapin the default mount configuration, and adding an additional set of rules to deny it in the default AppArmor profile.While
sysfsis not the only way to read from the RAPL subsystem, other ways of accessing it require additional capabilities such asCAP_SYS_RAWIOwhich is not available to containers by default, orperfparanoia level less than 1, which is a non-default kernel tunable.References
Release Notes
containerd/containerd (github.com/containerd/containerd)
v1.7.11: containerd 1.7.11Compare Source
Welcome to the v1.7.11 release of containerd!
The eleventh patch release for containerd 1.7 contains various fixes and updates including
one security issue.
Notable Updates
/sys/devices/virtual/powercappath in runtime spec and deny in default apparmor profile (GHSA-7ww5-4wqc-m92c)Deprecation Warnings
See the changelog for complete list of changes
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
39 commits
dfae68bc3Prepare release notes for v1.7.110d314401dupdate to go1.20.12, test go1.21.51ec1ae2c6update to go1.20.11, test go1.21.4cb804da21contrib/apparmor: deny /sys/devices/virtual/powercap40162a576oci/spec: deny /sys/devices/virtual/powercaped7c6895bDon't block snapshot garbage collection on Remove failures1fdefdd22Add warning for CRIU config usagef8f659e66Add HTTP client update function to tracing library807ddd658fix(tracing): use latest version of semconvdc45bc838Add cri-api v1alpha2 usage warning to all api calls9d1bad62edeprecation: fix missing spaces in warnings51a604c07cri: add deprecation warning for runtime_root8040e74bfcri: add deprecation warning for rutnime_engine99adc40ebcri: add deprecation warning for default_runtimeafef7ec64cri: add warning for untrusted_workload_runtime6220dc190cri: add warning for old form of systemd_cgroup80f96cd18runtime/v2: net.Dial gRPC shim sockets before trying grpcf471bb2b8tasks: emit warning for runc v1 runtime329e1d487tasks: emit warning for v1 runtime4464fde12push: always inherit distribution sources from parent7e069ee25Update tar tests to run on Darwin5fc0e4e61ctr: Add sandbox flag to ctr run31fe03764Fix windows default path overwrite issue625b35e4bsnapshots: emit deprecation warning for aufsDependency Changes
Previous release can be found at v1.7.10
v1.7.10: containerd 1.7.10Compare Source
Welcome to the v1.7.10 release of containerd!
The tenth patch release for containerd 1.7 contains various fixes and updates.
Notable Updates
See the changelog for complete list of changes
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
11 commits
a995fe3a8Add release notes for v1.7.10206806128remotes/docker: close connection if no more data328493962integration: reproduce #9347d1aab27cbfix: deflake TestCRIImagePullTimeout/HoldingContentOpenWritera2b16d7f9cri: fix update of pinned label for images8dc861844cri: fix using the pinned label to pin image5930a3750Enhance container image unpack client logsDependency Changes
This release has no dependency changes
Previous release can be found at v1.7.9
v1.7.9: containerd 1.7.9Compare Source
Welcome to the v1.7.9 release of containerd!
The ninth patch release for containerd 1.7 contains various fixes and updates.
Notable Updates
See the changelog for complete list of changes
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
28 commits
4b912af52Add release notes for v1.7.9eff291713update runc binary to v1.1.10bd9428ff7vendor: upgrade OpenTelemetry to v1.19.0 / v0.45.0d62cba40cExpose usage of cri-api v1alpha25dbc258a8integration: deflake TestIssue9103449912857fix: shimv1 leak issue152c57e91cri: add deprecation warning for configs689a1036dcri: add deprecation warning for auths8c38975bfcri: add deprecation warning for mirrors1fbce40c4cri: add ability to emit deprecation warnings73f15bdb6Update hcsshim tag to v0.11.460d48ffeactr: new deprecations command74a06671aplugin: record deprecation for dynamic pluginsfa5f3c91aserver: add ability to record config deprecationsf7880e7f0pull: record deprecation warning for schema 11dd2f2c02introspection: add support for deprecationsaaf000c18api/introspection: deprecation warnings in server9b7ceee54warning: new service for deprecationsb708f8bfadeprecation: new package for deprecationsDependency Changes
Previous release can be found at v1.7.8
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.