Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2022-0847 (The Dirty Pipe Vulnerability) #1118

Closed
travier opened this issue Mar 8, 2022 · 12 comments · Fixed by coreos/fedora-coreos-config#1583
Closed

CVE-2022-0847 (The Dirty Pipe Vulnerability) #1118

travier opened this issue Mar 8, 2022 · 12 comments · Fixed by coreos/fedora-coreos-config#1583
Labels
component/kernel kind/bug priority/high

Comments

@travier
Copy link
Member

travier commented Mar 8, 2022 •
edited

Describe the bug

Tracking issue for CVE-2022-0847 (The Dirty Pipe Vulnerability).

References:

This impacts containers too: https://blog.aquasec.com/cve-2022-0847-dirty-pipe-linux-vulnerability
@travier
Copy link
Member Author

travier commented Mar 8, 2022

From https://dirtypipe.cm4all.com/:

The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

Latest kernel in Fedora is kernel-5.16.12-200.fc35 which should have the fix.

@travier
Copy link
Member Author

travier commented Mar 8, 2022

We should probably do an async testing release.

@travier travier added priority/high status/pending-testing-release Fixed upstream. Waiting on a testing release. status/pending-next-release Fixed upstream. Waiting on a next release. component/kernel labels Mar 8, 2022
@travier
Copy link
Member Author

travier commented Mar 8, 2022 •
edited

This will bump the kernel from 5.15.18 to 5.16.12 which could introduce regressions.

@dustymabe
Copy link
Member

We should probably do an async testing release.

yes. and we should be able to bump the kernel now that https://gitlab.com/cki-project/kernel-ark/-/commit/ce338c425415d1e9623815d79bb88a98818f4157 landed (for #1066)

dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 8, 2022
@dustymabe
overrides: drop kernel pin
6dade5e 
This allows us to get the latest kernel-5.16.12-200.fc35. Moving to
a kernel newer than 5.16.11 picks up the fix fo CVE-2022-0847. We're
able to do this because the Fedora kernel maintainers agreed to again
pick up a revert that allows us to not regress on some AWS instance
types (coreos/fedora-coreos-tracker#1066).

Closes coreos/fedora-coreos-tracker#1118
@dustymabe dustymabe mentioned this issue Mar 8, 2022
Merged
@dustymabe
Copy link
Member

coreos/fedora-coreos-config#1583

dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 8, 2022
@dustymabe
overrides: fast-track kernel-5.16.12-200.fc35
0ef57c8 
This kernel picks up the fix to CVE-2022-0847, which was included in
kernels 5.6.11 and later.

See coreos/fedora-coreos-tracker#1118
@dustymabe dustymabe mentioned this issue Mar 8, 2022
Merged
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 8, 2022
@dustymabe
overrides: fast-track kernel-5.16.12-200.fc35
03fb444 
This kernel picks up the fix to CVE-2022-0847, which was included in
kernels 5.16.11 and later.

See coreos/fedora-coreos-tracker#1118
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 8, 2022
@dustymabe
overrides: fast-track kernel-5.16.12-200.fc35
d91d5e3 
This kernel picks up the fix to CVE-2022-0847, which was included in
kernels 5.16.11 and later.

See coreos/fedora-coreos-tracker#1118
@dustymabe dustymabe mentioned this issue Mar 8, 2022
Merged
@jlebon jlebon mentioned this issue Mar 8, 2022
Closed
@dustymabe
Copy link
Member

It turns out that https://gitlab.com/cki-project/kernel-ark/-/commit/ce338c425415d1e9623815d79bb88a98818f4157 didn't land in kernel-5.16.12-200.fc35 (turns out that kernel was built before that commit). So we need a new kernel build.

@dustymabe dustymabe reopened this Mar 8, 2022
@dustymabe
Copy link
Member

How do we prevent forks from closing issues?

@dustymabe dustymabe reopened this Mar 8, 2022
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
54aa07e 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
@dustymabe dustymabe mentioned this issue Mar 9, 2022
Merged
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
0b18bd8 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
bdb13ad 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
3ff8a70 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
b1d747a 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
ff6cd9f 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
261d49e 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
@dustymabe dustymabe mentioned this issue Mar 9, 2022
Merged
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
39e9c47 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
dustymabe added a commit to dustymabe/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
c891c77 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
dustymabe added a commit to coreos/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
bd7ebde 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
dustymabe added a commit to coreos/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
dbcafab 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
dustymabe added a commit to coreos/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
af24e24 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
dustymabe added a commit to coreos/fedora-coreos-config that referenced this issue Mar 9, 2022
@dustymabe
overrides: fast-track kernel-5.16.13-200.fc35
bba842e 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
@dustymabe dustymabe added the meeting topics for meetings label Mar 9, 2022
@rugk
Copy link
Contributor

rugk commented Mar 9, 2022

Should not you also send out a mail to that mailinglist once it is fixed?

@dustymabe
Copy link
Member

The fix for this went into next stream release 35.20220227.1.1. Please try out the new release and report issues.

@dustymabe
Copy link
Member

The fix for this went into testing stream release 35.20220227.2.1. Please try out the new release and report issues.

@dustymabe dustymabe added status/pending-stable-release Fixed upstream and in testing. Waiting on stable release. and removed status/pending-testing-release Fixed upstream. Waiting on a testing release. status/pending-next-release Fixed upstream. Waiting on a next release. labels Mar 10, 2022
@travier
Copy link
Member Author

travier commented Mar 11, 2022

#1121

@dustymabe dustymabe mentioned this issue Mar 14, 2022
Closed
@dustymabe
Copy link
Member

The fix for this went into stable stream release 35.20220227.3.0.

@dustymabe dustymabe removed the status/pending-stable-release Fixed upstream and in testing. Waiting on stable release. label Mar 16, 2022
@travier travier removed the meeting topics for meetings label Mar 16, 2022
HuijingHei pushed a commit to HuijingHei/fedora-coreos-config that referenced this issue Oct 10, 2023
@dustymabe @HuijingHei
overrides: drop kernel pin
7798db1 
This allows us to get the latest kernel-5.16.12-200.fc35. Moving to
a kernel newer than 5.16.11 picks up the fix fo CVE-2022-0847. We're
able to do this because the Fedora kernel maintainers agreed to again
pick up a revert that allows us to not regress on some AWS instance
types (coreos/fedora-coreos-tracker#1066).

Closes coreos/fedora-coreos-tracker#1118
HuijingHei pushed a commit to HuijingHei/fedora-coreos-config that referenced this issue Oct 10, 2023
@dustymabe @HuijingHei
overrides: fast-track kernel-5.16.13-200.fc35
3fcc876 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
HuijingHei pushed a commit to HuijingHei/fedora-coreos-config that referenced this issue Oct 10, 2023
@dustymabe @HuijingHei
overrides: drop kernel pin
11317ea 
This allows us to get the latest kernel-5.16.12-200.fc35. Moving to
a kernel newer than 5.16.11 picks up the fix fo CVE-2022-0847. We're
able to do this because the Fedora kernel maintainers agreed to again
pick up a revert that allows us to not regress on some AWS instance
types (coreos/fedora-coreos-tracker#1066).

Closes coreos/fedora-coreos-tracker#1118
HuijingHei pushed a commit to HuijingHei/fedora-coreos-config that referenced this issue Oct 10, 2023
@dustymabe @HuijingHei
overrides: fast-track kernel-5.16.13-200.fc35
c1dbcdb 
This is the first kernel with the most recent revert that allows
us to not regress on some AWS instance types [1]. Because it is
newer than 5.16.11 it also allows for us to pick up the fix to
CVE-2022-0847 [2].

[1] coreos/fedora-coreos-tracker#1066
[2] coreos/fedora-coreos-tracker#1118
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
component/kernel kind/bug priority/high
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

overrides: drop kernel pin dustymabe/fedora-coreos-config
3 participants
@dustymabe @rugk @travier