Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #237810 > unrolled thread

runc CVEs in docker.io

Back to article view | Back to linux.debian.user

Contents

  runc CVEs in docker.io "Gareth Evans" <donotspam@fastmail.fm> - 2021-07-27 18:10 +0200
    Re: runc CVEs in docker.io Dominique Dumont <dod@debian.org> - 2021-08-02 12:50 +0200
      Re: runc CVEs in docker.io "Gareth Evans" <donotspam@fastmail.fm> - 2021-08-04 14:50 +0200
        Re: runc CVEs in docker.io Dominique Dumont <dominique.dumont@netc.fr> - 2021-08-07 16:30 +0200
    Re: runc CVEs in docker.io Thomas Hochstein <thh@thh.name> - 2021-08-04 18:40 +0200

#237810 — runc CVEs in docker.io

Hello,

I was just trying to install docker.io on Buster stable when apt-listbugs complained about one of the open CVEs listed here:

https://security-tracker.debian.org/tracker/source-package/runc

Given that these are all fixed in Bullseye (and at least the grave apt-listbugs issue has been fixed in eg Ubuntu since March 2020 [1]) why not also Buster?

apt-listbugs said:

... CVE-2019-16884 (Fixed: runc/1.0.0~rc9+dfsg1-1) ...

According to 

https://tracker.debian.org/pkg/runc

there are 3 open security issues in (Stretch and) Buster (though I imagine Debian's support for Stretch has ended with EOL in 2020?) - do fixes like this come in batches?  

Thanks,
Gareth

[1] https://ubuntu.com/security/notices/USN-4297-1

[toc] | [next] | [standalone]

#238016

On Tuesday, 27 July 2021 18:07:53 CEST Gareth Evans wrote:
> Given that these are all fixed in Bullseye (and at least the grave
> apt-listbugs issue has been fixed in eg Ubuntu since March 2020 [1]) why
> not also Buster?

According to runc security tracker, a fixed runc is available for buster, 
albeit in buster's security repository.

I guess that security repo is missing from your /etc/apt/sources.list

See https://www.debian.org/security/#keeping-secure for instructions.

HTH

Dod

[toc] | [prev] | [next] | [standalone]

#238132

On Mon  2 Aug 2021, at 11:48, Dominique Dumont <dod@debian.org> wrote:
> On Tuesday, 27 July 2021 18:07:53 CEST Gareth Evans wrote:
> > Given that these are all fixed in Bullseye (and at least the grave
> > apt-listbugs issue has been fixed in eg Ubuntu since March 2020 [1]) why
> > not also Buster?
> 

> According to runc security tracker, a fixed runc is available for buster, 
> albeit in buster's security repository.

Thanks Dominique, do you have a link for this please?  All I can find is

https://security-tracker.debian.org/tracker/source-package/runc

which includes 

"available versions
...
buster	1.0.0~rc6+dfsg1-3"

and in the section following that, the ~rc6 version is apparently vulnerable on Buster to all open issues listed (at the time of writing), including CVE-2019-16884 complained of by apt-listbugs.  I can't see any reference there to a security repo version, and my system doesn't find it, even after adding the line suggested in "keeping secure" [link below] to sources.list

> I guess that security repo is missing from your /etc/apt/sources.list
> 
> See https://www.debian.org/security/#keeping-secure for instructions.

I already had a couple of references to security repos (do they all point to the same thing?) but added the line suggested anyway - but no change even after reboot and a second update.


$ sudo cat /etc/apt/sources.list
deb https://deb.debian.org/debian buster contrib main non-free
deb https://deb.debian.org/debian buster-updates contrib main non-free
deb https://deb.debian.org/debian-security/ buster/updates contrib main non-free
deb https://deb.debian.org/debian buster-backports contrib main non-free
deb https://security.debian.org/ buster/updates contrib main non-free
deb https://security.debian.org/debian-security buster/updates contrib main non-free


$ sudo apt update
Hit:1 https://security.debian.org buster/updates InRelease
Hit:2 https://deb.debian.org/debian buster InRelease
Hit:3 https://linux.teamviewer.com/deb stable InRelease
Hit:4 https://security.debian.org/debian-security buster/updates InRelease
Hit:5 https://deb.debian.org/debian buster-updates InRelease
Hit:6 https://deb.debian.org/debian-security buster/updates InRelease
Hit:7 https://deb.debian.org/debian buster-backports InRelease
...
All packages are up to date.


$ sudo apt install docker.io
...
grave bugs of runc (→ 1.0.0~rc6+dfsg1-3) <Resolved in some Version>
 b1 - #942026 - runc: CVE-2019-16884 (Fixed: runc/1.0.0~rc9+dfsg1-1)
Summary:
 runc(1 bug)
Are you sure you want to install/upgrade the above packages? [Y/n/?/...] 


Tracker still shows that CVE and two others as open security issues in Buster.  

https://tracker.debian.org/pkg/runc

and

$ apt policy runc
runc:
  Installed: (none)
  Candidate: 1.0.0~rc6+dfsg1-3
  Version table:
     1.0.0~rc6+dfsg1-3 500
        500 https://deb.debian.org/debian buster/main amd64 Packages


Grateful for any further advice.

Thanks,
Gareth

> 
> HTH
> 
> Dod
> 
> 
> 
> 

[toc] | [prev] | [next] | [standalone]

#238328

On mercredi 4 août 2021 14:41:02 CEST Gareth Evans wrote:
> > According to runc security tracker, a fixed runc is available for buster,
> > albeit in buster's security repository.
> 
> Thanks Dominique, do you have a link for this please?

Sorry, my bad. 

I misread the report.

All the best

[toc] | [prev] | [next] | [standalone]

#238140

Gareth Evans schrieb:

> Given that these are all fixed in Bullseye (and at least the grave
> apt-listbugs issue has been fixed in eg Ubuntu since March 2020 [1])
> why not also Buster?
[...]
> According to 
> 
> https://tracker.debian.org/pkg/runc
> 
> there are 3 open security issues in (Stretch and) Buster

Most are marked "vulnerable (no DSA)". According to
<https://security-team.debian.org/triage.html> and
<https://security-team.debian.org/security_tracker.html#issues-not-warranting-a-security-advisory>,
that may mean that minor issues will be fixed with a point update or
"are simply not worth fixing in a stable release".

CVE-2021-30465 is scheduled to get a security update for buster.

> (though I
> imagine Debian's support for Stretch has ended with EOL in 2020?) -

Stretch will get security support via the Debian LTS project
(<https://wiki.debian.org/LTS>) until the end of June, 2022.

Debian Jessie still gets some security support via the Debian ELTS
project (<https://wiki.debian.org/LTS/Extended>) for the same time
period. Most probably the same will happen for Stretch after LTS
support has ended.

-thh

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web