Schwachstellen im Stack Container · Seite 5

moby/moby's dockerd daemon encrypted overlay network may be unauthenticated

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communicatio

• Auf 20.10.21-0ubuntu1~18.04.3+esm3 aktualisieren
• Auf 20.10.21-0ubuntu1~20.04.6+esm2 aktualisieren
• Auf 20.10.21-0ubuntu1~22.04.7+esm2 aktualisieren
• Auf 20.10.24+dfsg1-1 aktualisieren

moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communica

• Auf 20.10.21-0ubuntu1~18.04.3+esm3 aktualisieren
• Auf 20.10.21-0ubuntu1~20.04.6+esm2 aktualisieren
• Auf 20.10.21-0ubuntu1~22.04.7+esm2 aktualisieren
• Auf 20.10.24+dfsg1-1 aktualisieren
• Auf 26.1.3-0ubuntu1~20.04.1+esm1 aktualisieren
• Auf 27.5.1-0ubuntu3~22.04.2 aktualisieren

moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated

Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communic

• Auf 20.10.21-0ubuntu1~18.04.3+esm3 aktualisieren
• Auf 20.10.21-0ubuntu1~20.04.6+esm2 aktualisieren
• Auf 20.10.21-0ubuntu1~22.04.7+esm2 aktualisieren
• Auf 20.10.24+dfsg1-1 aktualisieren
• Auf 26.1.3-0ubuntu1~20.04.1+esm1 aktualisieren
• Auf 27.5.1-0ubuntu3~22.04.2 aktualisieren

rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc

runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/

• Auf 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4 aktualisieren
• Auf 1.1.4-0ubuntu1~18.04.2 aktualisieren
• Auf 1.1.4-0ubuntu1~20.04.3 aktualisieren
• Auf 1.1.4-0ubuntu1~22.04.3 aktualisieren
• Auf 1.1.5+ds1-1 aktualisieren

AppArmor bypass with symlinked /proc in runc

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

• Auf 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4 aktualisieren
• Auf 1.1.4-0ubuntu1~18.04.2 aktualisieren
• Auf 1.1.4-0ubuntu1~20.04.3 aktualisieren
• Auf 1.1.4-0ubuntu1~22.04.3 aktualisieren
• Auf 1.1.5+ds1-1 aktualisieren

Node address isn't always verified when proxying

Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.

• Auf 1.20.5+really1.20.2-1 aktualisieren

Unauthorized read of Custom Resources

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.

• Auf 1.20.5+really1.20.2-1 aktualisieren

containerd supplementary groups are not set up properly

containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users

• Auf 1.2.6-0ubuntu1~16.04.6+esm4 aktualisieren
• Auf 1.6.12-0ubuntu1~18.04.1+esm1 aktualisieren
• Auf 1.6.12-0ubuntu1~20.04.3 aktualisieren
• Auf 1.6.12-0ubuntu1~22.04.3 aktualisieren
• Auf 1.6.18~ds1-1 aktualisieren

containerd OCI image importer memory exhaustion

containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

• Auf 1.2.6-0ubuntu1~16.04.6+esm4 aktualisieren
• Auf 1.6.12-0ubuntu1~18.04.1+esm1 aktualisieren
• Auf 1.6.12-0ubuntu1~20.04.3 aktualisieren
• Auf 1.6.12-0ubuntu1~22.04.3 aktualisieren
• Auf 1.6.18~ds1-1 aktualisieren

containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak

containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these ver

• Auf 1.5.9-0ubuntu1~18.04.2 aktualisieren
• Auf 1.5.9-0ubuntu1~20.04.6 aktualisieren
• Auf 1.5.9-0ubuntu3.1 aktualisieren
• Auf 1.6.12~ds1-1 aktualisieren

Moby vulnerability relating to supplementary group permissions

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgr

• Auf 20.10.19+dfsg1-1 aktualisieren
• Auf 20.10.21-0ubuntu1~18.04.2 aktualisieren
• Auf 20.10.21-0ubuntu1~20.04.1 aktualisieren
• Auf 20.10.21-0ubuntu1~22.04.2 aktualisieren

Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

containerd CRI plugin: Host memory exhaustion through ExecSync

containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve t

• Auf 1.2.6-0ubuntu1~16.04.6+esm2 aktualisieren
• Auf 1.5.9-0ubuntu1~18.04.2 aktualisieren
• Auf 1.5.9-0ubuntu1~20.04.6 aktualisieren
• Auf 1.5.9-0ubuntu3.1 aktualisieren
• Auf 1.6.6~ds1-1 aktualisieren

Incorrect Default Permissions in runc

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` beh

• Auf 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4 aktualisieren
• Auf 1.1.3+ds1-1 aktualisieren

Default inheritable capabilities for linux container should be empty

Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due t

• Auf 1.5.9-0ubuntu1~18.04.2 aktualisieren
• Auf 1.5.9-0ubuntu1~20.04.6 aktualisieren
• Auf 1.5.9-0ubuntu3.1 aktualisieren
• Auf 1.6.2~ds1-1 aktualisieren

Insecure handling of image volumes in containerd CRI plugin

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.1

• Auf 1.5.5-0ubuntu3~18.04.2 aktualisieren
• Auf 1.5.9-0ubuntu1~20.04.4 aktualisieren
• Auf 1.5.9-0ubuntu2 aktualisieren
• Auf 1.6.1~ds1-1 aktualisieren

Bypass of Kubernetes API Server proxy TOCTOU

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction

• Auf 1.20.5+really1.20.2-1 aktualisieren

ANSI escape characters in kubectl output are not being filtered

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

• Auf 1.20.5+really1.20.2-1.1 aktualisieren
• Auf 1.31.4+ds-1 aktualisieren

Improper Preservation of Permissions in containerd

containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permi

• Auf 1.5.9-0ubuntu1 aktualisieren
• Auf 1.5.9-0ubuntu1~18.04.1 aktualisieren
• Auf 1.5.9-0ubuntu1~20.04.4 aktualisieren
• Auf 1.5.9~ds1-1 aktualisieren

Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container config

• Auf 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4 aktualisieren
• Auf 1.0.3+ds1-1 aktualisieren