Update module github.com/opencontainers/runc to v1.1.14 [SECURITY] #107
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![bootc-bot[bot]](https://avatars.githubusercontent.com/u/202312630?s=60&v=4){kind=small}
Signed-off-by: Platform Engineering Bot <[email protected]>
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.1.12->v1.1.14Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2024-45310
Impact
runc 1.1.13 and earlier as well as 1.2.0-rc2 and earlier can be tricked into
creating empty files or directories in arbitrary locations in the host
filesystem by sharing a volume between two containers and exploiting a race
with os.MkdirAll. While this can be used to create empty files, existing
files will not be truncated.
An attacker must have the ability to start containers using some kind of custom
volume configuration. Containers using user namespaces are still affected, but
the scope of places an attacker can create inodes can be significantly reduced.
Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block
this attack -- we suspect the industry standard SELinux policy may restrict
this attack's scope but the exact scope of protection hasn't been analysed.
This is exploitable using runc directly as well as through Docker and
Kubernetes.
The CVSS score for this vulnerability is
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N (Low severity, 3.6).
Workarounds
Using user namespaces restricts this attack fairly significantly such that the
attacker can only create inodes in directories that the remapped root
user/group has write access to. Unless the root user is remapped to an actual
user on the host (such as with rootless containers that don't use
/etc/sub[ug]id), this in practice means that an attacker would only be able to
create inodes in world-writable directories.
A strict enough SELinux or AppArmor policy could in principle also restrict the
scope if a specific label is applied to the runc runtime, though we haven't
thoroughly tested to what extent the standard existing policies block this
attack nor what exact policies are needed to sufficiently restrict this attack.
Patches
Fixed in runc v1.1.14 and v1.2.0-rc3.
mainpatches:release-1.1patches:Credits
Thanks to Rodrigo Campos Catelin (@rata) and Alban Crequy (@alban) from
Microsoft for discovering and reporting this vulnerability.
Release Notes
opencontainers/runc (github.com/opencontainers/runc)
v1.1.14Compare Source
As runc follows Semantic Versioning, we will endeavour to not make any
breaking changes without bumping the major version number of runc.
However, it should be noted that Go API usage of runc's internal
implementation (libcontainer) is not covered by this policy.
Removed
use libcontainer/devices). (#2999)
rc94, use libcontainer/userns). (#2999)
Deprecated
(such configurations are outside of the spec, and in future runc will
produce an error when given such configurations). (#2917, #3004)
Fixed
results with cgroupv1, and always clobber any existing eBPF
program(s) to fix
runc updateand avoid leaking eBPF programs(resulting in errors when managing containers). (#2951)
cgroupv1-compatible way. (#2965, #2967, #2968, #2964)
code, optimize the method for checking whether a cgroup is frozen. (#2955)
cgroup manager (regression in rc94). (#2997, #2996)
Added
(#3022)
Changed
runc --versionoutput sane even when built withgo getorotherwise outside of our build scripts. (#2962)
cgroups at all during
runc update). (#2994)v1.1.13Compare Source
As runc follows Semantic Versioning, we will endeavour to not make any
breaking changes without bumping the major version number of runc.
However, it should be noted that Go API usage of runc's internal
implementation (libcontainer) is not covered by this policy.
Removed
use libcontainer/devices). (#2999)
rc94, use libcontainer/userns). (#2999)
Deprecated
(such configurations are outside of the spec, and in future runc will
produce an error when given such configurations). (#2917, #3004)
Fixed
results with cgroupv1, and always clobber any existing eBPF
program(s) to fix
runc updateand avoid leaking eBPF programs(resulting in errors when managing containers). (#2951)
cgroupv1-compatible way. (#2965, #2967, #2968, #2964)
code, optimize the method for checking whether a cgroup is frozen. (#2955)
cgroup manager (regression in rc94). (#2997, #2996)
Added
(#3022)
Changed
runc --versionoutput sane even when built withgo getorotherwise outside of our build scripts. (#2962)
cgroups at all during
runc update). (#2994)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.