CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

• HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

• runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• avc: podman run --security-opt label=type:svirt_qemu_net_t (BZ#1764318)

• backport json-file logging support to 1.4.2 (BZ#1770176)

• Selinux won't allow SCTP inter pod communication (BZ#1774382)

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

• HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

• runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• avc: podman run --security-opt label=type:svirt_qemu_net_t (BZ#1764318)

• backport json-file logging support to 1.4.2 (BZ#1770176)

• Selinux won't allow SCTP inter pod communication (BZ#1774382)

AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory (CVE-2019-16884).

This update for docker-runc fixes the following issues:

• CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)

This update was imported from the SUSE:SLE-15:Update update project.

This update for docker-runc fixes the following issues:

• CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)

This update was imported from the SUSE:SLE-15:Update update project.

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:

Security issue fixed:

• CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory (bsc#1152308).

Bug fixes:

• Update to Docker 19.03.5-ce (bsc#1158590).
• Update to Docker 19.03.3-ce (bsc#1153367).
• Update to Docker 19.03.2-ce (bsc#1150397).
• Fixed default installation such that --userns-remap=default works properly (bsc#1143349).
• Fixed nginx blocked by apparmor (bsc#1122469).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the runc-1.0.2-1.2 package on the GA media of openSUSE Tumbleweed.

This update for docker-runc fixes the following issues:

• CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)

This update for docker-runc fixes the following issues:

• CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)

This update for runc fixes the following issues:

Security issue fixed:

• CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)

Non-security issues fixed:

• Includes upstreamed patches for regressions (bsc#1131314 bsc#1131553).

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:

Security issue fixed:

• CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory (bsc#1152308).

Bug fixes:

• Update to Docker 19.03.5-ce (bsc#1158590).
• Update to Docker 19.03.3-ce (bsc#1153367).
• Update to Docker 19.03.2-ce (bsc#1150397).
• Fixed default installation such that --userns-remap=default works properly (bsc#1143349).
• Fixed nginx blocked by apparmor (bsc#1122469).

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:

Security issue fixed:

• CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory (bsc#1152308).

Bug fixes:

• Update to Docker 19.03.5-ce (bsc#1158590).
• Update to Docker 19.03.3-ce (bsc#1153367).
• Update to Docker 19.03.2-ce (bsc#1150397).
• Fixed default installation such that --userns-remap=default works properly (bsc#1143349).
• Fixed nginx blocked by apparmor (bsc#1122469).

This update for containerd, docker, runc fixes the following issues:

• Docker was updated to 20.10.6-ce

  • Switch version to use -ce suffix rather than _ce to avoid confusing other tools (bsc#1182476).
  • CVE-2021-21284: Fixed a potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732)
  • CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest crashes the dockerd daemon (bsc#1181730).

• runc was updated to v1.0.0~rc93 (bsc#1182451 and bsc#1184962).

  • Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).
  • Fixed /dev/null is not available (bsc#1168481).
  • Fixed an issue where podman hangs when spawned by salt-minion process (bsc#1149954).
  • CVE-2019-19921: Fixed a race condition with shared mounts (bsc#1160452).
  • CVE-2019-16884: Fixed an LSM bypass via malicious Docker image that mount over a /proc directory (bsc#1152308).
  • CVE-2019-5736: Fixed potential write attacks to the host runc binary (bsc#1121967).
  • Fixed an issue where after a kernel-update docker doesn't run (bsc#1131314 bsc#1131553)
  • Ensure that we always include the version information in runc (bsc#1053532).

• Switch to Go 1.13 for build.

  • CVE-2018-16873: Fixed a potential remote code execution (bsc#1118897).
  • CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces in import paths (bsc#1118898).
  • CVE-2018-16875: Fixed a CPU denial of service (bsc#1118899).
  • Fixed an issue with building containers (bsc#1095817).

• containerd was updated to v1.4.4

  • CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).
  • Handle a requirement from docker (bsc#1181594).
  • Install the containerd-shim* binaries and stop creating (bsc#1183024).
  • update version to the one required by docker (bsc#1034053)

• Use -buildmode=pie for tests and binary build (bsc#1048046, bsc#1051429)

• Cleanup seccomp builds similar (bsc#1028638).

• Update to handle the docker-runc removal, and drop the -kubic flavour (bsc#1181677, bsc#1181749)

It was discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount over the /proc directory and escalate privileges. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-16884)

It was discovered that runC incorrectly performed access control. An attacker could possibly use this issue to escalate privileges. (CVE-2019-19921)

It was discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount over the /proc directory and escalate privileges. (CVE-2019-16884)

Etienne Champetier discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount the host filesystem into the container and escalate privileges. (CVE-2021-30465)