Skip to content

Commit

Permalink
update runc binary to v1.1.2
Browse files Browse the repository at this point in the history
This is the second patch release of the runc 1.1 release branch. It
fixes CVE-2022-29162, a minor security issue (which appears to not be
exploitable) related to process capabilities.

This is a similar bug to the ones found and fixed in Docker and
containerd recently (CVE-2022-24769).

- A bug was found in runc where runc exec --cap executed processes with
  non-empty inheritable Linux process capabilities, creating an atypical Linux
  environment. For more information, see GHSA-f3fp-gc8g-vw66 and CVE-2022-29162.
- runc spec no longer sets any inheritable capabilities in the created
  example OCI spec (config.json) file.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
  • Loading branch information
thaJeztah committed May 12, 2022
1 parent 7c69b6d commit bc0fd3f
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion hack/dockerfile/install/runc.installer
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ set -e
# the containerd project first, and update both after that is merged.
#
# When updating RUNC_VERSION, consider updating runc in vendor.mod accordingly
: "${RUNC_VERSION:=v1.1.1}"
: "${RUNC_VERSION:=v1.1.2}"

install_runc() {
RUNC_BUILDTAGS="${RUNC_BUILDTAGS:-"seccomp"}"
Expand Down

0 comments on commit bc0fd3f

Please sign in to comment.