containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `"USER $USERNAME"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups.
Created containerd tracking bugs for this issue: Affects: fedora-all [bug 2174486]
Created apptainer tracking bugs for this issue: Affects: epel-all [bug 2174511] Affects: fedora-all [bug 2174518] Created buildah tracking bugs for this issue: Affects: fedora-all [bug 2174519] Created conmon tracking bugs for this issue: Affects: fedora-all [bug 2174520] Created cri-o tracking bugs for this issue: Affects: fedora-all [bug 2174521] Created cri-o:1.20/cri-o tracking bugs for this issue: Affects: fedora-36 [bug 2174522] Created cri-o:1.21/cri-o tracking bugs for this issue: Affects: epel-8 [bug 2174515] Affects: fedora-36 [bug 2174523] Created cri-o:1.22/cri-o tracking bugs for this issue: Affects: fedora-36 [bug 2174524] Created cri-o:1.23/cri-o tracking bugs for this issue: Affects: fedora-36 [bug 2174525] Created cri-o:1.24/cri-o tracking bugs for this issue: Affects: fedora-all [bug 2174526] Created cri-o:1.25/cri-o tracking bugs for this issue: Affects: fedora-all [bug 2174527] Created doctl tracking bugs for this issue: Affects: fedora-37 [bug 2174541] Created golang-github-containerd-fuse-overlayfs-snapshotter tracking bugs for this issue: Affects: fedora-36 [bug 2174528] Created golang-github-deislabs-oras tracking bugs for this issue: Affects: fedora-all [bug 2174529] Created golang-github-docker-slim tracking bugs for this issue: Affects: fedora-37 [bug 2174542] Affects: fedora-all [bug 2174530] Created golang-github-google-containerregistry tracking bugs for this issue: Affects: fedora-36 [bug 2174531] Created golang-github-moby-buildkit tracking bugs for this issue: Affects: fedora-36 [bug 2174532] Created golang-github-prometheus tracking bugs for this issue: Affects: epel-all [bug 2174512] Affects: fedora-36 [bug 2174533] Created golang-gvisor tracking bugs for this issue: Affects: fedora-all [bug 2174534] Created golang-helm-3 tracking bugs for this issue: Affects: fedora-all [bug 2174543] Created manifest-tool tracking bugs for this issue: Affects: fedora-36 [bug 2174535] Created moby-engine tracking bugs for this issue: Affects: fedora-all [bug 2174544] Created origin tracking bugs for this issue: Affects: fedora-all [bug 2174545] Created pack tracking bugs for this issue: Affects: epel-8 [bug 2174517] Affects: fedora-36 [bug 2174536] Created podman tracking bugs for this issue: Affects: fedora-all [bug 2174537] Created podman-tui tracking bugs for this issue: Affects: fedora-all [bug 2174538] Created reg tracking bugs for this issue: Affects: epel-all [bug 2174513] Affects: fedora-36 [bug 2174539] Created singularity-ce tracking bugs for this issue: Affects: epel-all [bug 2174514] Created stargz-snapshotter tracking bugs for this issue: Affects: fedora-all [bug 2174540]
Hi Anten / prodsec, for future cve bzs, could you please also include a link to the vulnerable code + patch that fixes it? Sure, one could google around, but it'd be really convenient to have it in the Bug description itself. I say this because I've noticed many of the golang packages often don't end up using the actual vulnerable code, so they may not need any updates.
References: https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a https://github.com/containerd/containerd/releases/tag/v1.5.18 https://github.com/containerd/containerd/releases/tag/v1.6.18 https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
This issue has been addressed in the following products: Red Hat Migration Toolkit for Containers 1.7 Via RHSA-2023:2107 https://access.redhat.com/errata/RHSA-2023:2107
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2023:1372 https://access.redhat.com/errata/RHSA-2023:1372
This issue has been addressed in the following products: Red Hat OpenShift Security Profiles Operator stable on RHEL-8 Red Hat OpenShift Security Profiles Operator stable on RHEL-9 Via RHSA-2023:2029 https://access.redhat.com/errata/RHSA-2023:2029
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2023:1326 https://access.redhat.com/errata/RHSA-2023:1326
This issue has been addressed in the following products: Openshift Serverless 1 on RHEL 8 Via RHSA-2023:3450 https://access.redhat.com/errata/RHSA-2023:3450
This issue has been addressed in the following products: RHOSS-1.29-RHEL-8 Via RHSA-2023:3455 https://access.redhat.com/errata/RHSA-2023:3455
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2023:3537 https://access.redhat.com/errata/RHSA-2023:3537
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2023:4025 https://access.redhat.com/errata/RHSA-2023:4025
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2023:4226 https://access.redhat.com/errata/RHSA-2023:4226
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.11 Via RHSA-2023:4488 https://access.redhat.com/errata/RHSA-2023:4488
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2023:4671 https://access.redhat.com/errata/RHSA-2023:4671
This issue has been addressed in the following products: OADP-1.1-RHEL-8 Via RHSA-2023:5314 https://access.redhat.com/errata/RHSA-2023:5314
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2023:5006 https://access.redhat.com/errata/RHSA-2023:5006
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:6473 https://access.redhat.com/errata/RHSA-2023:6473
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:6474 https://access.redhat.com/errata/RHSA-2023:6474
This issue has been addressed in the following products: RHEL-9-CNV-4.14 Via RHSA-2023:6817 https://access.redhat.com/errata/RHSA-2023:6817
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:6939 https://access.redhat.com/errata/RHSA-2023:6939