fix(deps): update module github.com/opencontainers/runc to v1.1.5 [security] #8770
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.1.4
->v1.1.5
⚠ Dependency Lookup Warnings ⚠
Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2023-27561
runc 1.0.0-rc95 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to
libcontainer/rootfs_linux.go
. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.CVE-2023-25809
Impact
It was found that rootless runc makes
/sys/fs/cgroup
writable in following conditons:config.json
does not specify the cgroup namespace to be unshared (e.g..,(docker|podman|nerdctl) run --cgroupns=host
, with Rootless Docker/Podman/nerdctl)/sys
is mounted withrbind, ro
(e.g.,runc spec --rootless
; this condition is very rare)A container may gain the write access to user-owned cgroup hierarchy
/sys/fs/cgroup/user.slice/...
on the host .Other users's cgroup hierarchies are not affected.
Patches
v1.1.5 (planned)
Workarounds
(docker|podman|nerdctl) run --cgroupns=private)
. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts./sys/fs/cgroup
tomaskedPaths
CVE-2023-28642
Impact
It was found that AppArmor, and potentially SELinux, can be bypassed when
/proc
inside the container is symlinked with a specific mount configuration.Patches
Fixed in runc v1.1.5, by prohibiting symlinked
/proc
: https://github.com/opencontainers/runc/pull/3785This PR fixes CVE-2023-27561 as well.
Workarounds
Avoid using an untrusted container image.
Release Notes
opencontainers/runc
v1.1.5
: runc 1.1.5 -- "囚われた屈辱は 反撃の嚆矢だ"Compare Source
This is the fifth patch release in the 1.1.z series of runc, which fixes
three CVEs found in runc.
CVE-2023-25809 is a vulnerability involving rootless containers where
(under specific configurations), the container would have write access
to the /sys/fs/cgroup/user.slice/... cgroup hierarchy. No other
hierarchies on the host were affected. This vulnerability was
discovered by Akihiro Suda.
GHSA-m8cg-xc2p-r3fc
CVE-2023-27561 was a regression which effectively re-introduced
CVE-2019-19921. This bug was present from v1.0.0-rc95 to v1.1.4. This
regression was discovered by @Beuc.
GHSA-vpvm-3wq2-2wvm
CVE-2023-28642 is a variant of CVE-2023-27561 and was fixed by the same
patch. This variant of the above vulnerability was reported by Lei
Wang.
GHSA-g2j6-57v7-gm8c
In addition, the following other fixes are included in this release:
/dev/null
when inside a container. (#3620)/dev/null
caused by fd redirection(a regression in 1.1.1). (#3674, #3731)
CentOS < 7.7. (#3776)
write_log()
. (#3721)Static Linking Notices
The
runc
binary distributed with this release are statically linked withthe following GNU LGPL-2.1 licensed libraries, with
runc
actingas a "work that uses the Library":
The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.
However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.
Thanks to all of the contributors who made this release possible:
[Due to the security-critical nature of this release, it was released
without a direct vote but was agreed to by the required number of
maintainers.]
Signed-off-by: Aleksa Sarai cyphar@cyphar.com
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.