MGASA-2025-0004 - Updated opencontainers-runc packages fix security vulnerability

Publication date: 10 Jan 2025
URL: https://advisories.mageia.org/MGASA-2025-0004.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2024-45310

runc 1.1.13 and earlier as well as 1.2.0-rc2 and earlier can be tricked into
creating empty files or directories in arbitrary locations in the host
filesystem by sharing a volume between two containers and exploiting a race
with os.MkdirAll. While this can be used to create empty files, existing
files **will not** be truncated.  An attacker must have the ability to start
containers using some kind of custom volume configuration. Containers using
user namespaces are still affected, but the scope of places an attacker can
create inodes can be significantly reduced.  Sufficiently strict LSM policies
(SELinux/Apparmor) can also in principle block this attack -- we suspect the
industry standard SELinux policy may restrict this attack's scope but the
exact scope of protection hasn't been analysed.  This is exploitable using
runc directly as well as through Docker and Kubernetes.

References:
- https://bugs.mageia.org/show_bug.cgi?id=33519
- https://www.openwall.com/lists/oss-security/2024/09/03/1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45310

SRPMS:
- 9/core/opencontainers-runc-1.1.14-1.mga9