fix(deps): update module github.com/opencontainers/runc to v1.1.5 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/opencontainers/runc	require	patch	v1.1.4 -> v1.1.5

GitHub Vulnerability Alerts

CVE-2023-27561

runc 1.0.0-rc95 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

CVE-2023-25809

Impact

It was found that rootless runc makes /sys/fs/cgroup writable in following conditons:

1. when runc is executed inside the user namespace, and the config.json does not specify the cgroup namespace to be unshared (e.g.., (docker|podman|nerdctl) run --cgroupns=host, with Rootless Docker/Podman/nerdctl)
2. or, when runc is executed outside the user namespace, and /sys is mounted with rbind, ro (e.g., runc spec --rootless; this condition is very rare)

A container may gain the write access to user-owned cgroup hierarchy /sys/fs/cgroup/user.slice/... on the host .
Other users's cgroup hierarchies are not affected.

Patches

v1.1.5 (planned)

Workarounds

• Condition 1: Unshare the cgroup namespace ((docker|podman|nerdctl) run --cgroupns=private). This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts.
• Condition 2 (very rare): add /sys/fs/cgroup to maskedPaths

CVE-2023-28642

Impact

It was found that AppArmor, and potentially SELinux, can be bypassed when /proc inside the container is symlinked with a specific mount configuration.

Patches

Fixed in runc v1.1.5, by prohibiting symlinked /proc: https://github.com/opencontainers/runc/pull/3785

This PR fixes CVE-2023-27561 as well.

Workarounds

Avoid using an untrusted container image.

---

Release Notes

opencontainers/runc

v1.1.5: runc 1.1.5 -- "囚われた屈辱は　反撃の嚆矢だ"

Compare Source

This is the fifth patch release in the 1.1.z series of runc, which fixes
three CVEs found in runc.

• CVE-2023-25809 is a vulnerability involving rootless containers where
  (under specific configurations), the container would have write access
  to the /sys/fs/cgroup/user.slice/... cgroup hierarchy. No other
  hierarchies on the host were affected. This vulnerability was
  discovered by Akihiro Suda.
  GHSA-m8cg-xc2p-r3fc

• CVE-2023-27561 was a regression which effectively re-introduced
  CVE-2019-19921. This bug was present from v1.0.0-rc95 to v1.1.4. This
  regression was discovered by @​Beuc.
  GHSA-vpvm-3wq2-2wvm

• CVE-2023-28642 is a variant of CVE-2023-27561 and was fixed by the same
  patch. This variant of the above vulnerability was reported by Lei
  Wang.
  GHSA-g2j6-57v7-gm8c

In addition, the following other fixes are included in this release:

• Fix the inability to use /dev/null when inside a container. (#​3620)
• Fix changing the ownership of host's /dev/null caused by fd redirection
  (a regression in 1.1.1). (#​3674, #​3731)
• Fix rare runc exec/enter unshare error on older kernels, including
  CentOS < 7.7. (#​3776)
• nsexec: Check for errors in write_log(). (#​3721)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

• libseccomp

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

---

Thanks to all of the contributors who made this release possible:

• Akihiro Suda akihiro.suda.cz@hco.ntt.co.jp
• Aleksa Sarai cyphar@cyphar.com
• Evan Phoenix evan@phx.io
• Jaroslav Jindrak dzejrou@gmail.com
• Kir Kolyshkin kolyshkin@gmail.com
• Mrunal Patel mrunal@me.com
• Rodrigo Campos rodrigoca@microsoft.com
• Sebastiaan van Stijn thaJeztah@users.noreply.github.com
• Shengjing Zhu zhsj@debian.org
• Tianon Gravi admwiggin@gmail.com

[Due to the security-critical nature of this release, it was released
without a direct vote but was agreed to by the required number of
maintainers.]

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[rhatdan]

LGTM