Bug 30111

Summary:	docker-containerd new security issue CVE-2022-23648
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	andrewsfarm, bruno, davidwhodgins, rolfpedersen, sysadmin-bugs, tarazed25
Version:	8	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA8-64-OK
Source RPM:	docker-containerd-1.5.9-1.mga8.src.rpm	CVE:
Status comment:

Description David Walser 2022-03-03 21:48:39 CET

Upstream has issued an advisory on March 2:
https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7

The issue is fixed upstream in 1.5.10.

Mageia 8 is also affected.

David Walser 2022-03-03 21:48:52 CET

Status comment: (none) => Fixed upstream in 1.5.10
Whiteboard: (none) => MGA8TOO

Comment 1 David Walser 2022-03-03 22:03:47 CET

Ubuntu has issued an advisory for this today (March 3):
https://ubuntu.com/security/notices/USN-5311-1

Comment 2 Bruno Cornec 2022-03-04 02:14:48 CET

1.5.10 pushed to both cauldron and mga8

Assignee: bruno => qa-bugs
CC: (none) => bruno
Whiteboard: MGA8TOO => (none)
Version: Cauldron => 8
Status: NEW => ASSIGNED

Comment 3 David Walser 2022-03-04 03:56:16 CET

docker-containerd-1.5.10-1.mga8

from docker-containerd-1.5.10-1.mga8.src.rpm

Status comment: Fixed upstream in 1.5.10 => (none)

Comment 4 Len Lawrence 2022-03-04 20:07:50 CET

mga8, x64

Installed docker from scratch and added user to docker group.
Started docker daemon and ran docker - loaded the debian version of hello-world into a bash shell in a docker container to check that all was working OK.  Backed out and updated docker-containerd and restarted docker - status running.

$ docker run -ti fedora:latest /bin/bash
Unable to find image 'fedora:latest' locally
latest: Pulling from library/fedora
edad61c68e67: Pull complete 
Digest: sha256:40ba585f0e25c096a08c30ab2f70ef3820b8ea5a4bdd16da0edbfc0a6952fa57
Status: Downloaded newer image for fedora:latest
[root@0d9eb25de685 /]# exit
exit

$ docker ps -a
CONTAINER ID   IMAGE           COMMAND                CREATED          STATUS                        PORTS     NAMES
0d9eb25de685   fedora:latest   "/bin/bash"            2 minutes ago    Exited (127) 28 seconds ago             brave_benz
377efb2742c9   debian          "/bin/bash"            14 minutes ago   Exited (0) 13 minutes ago               thirsty_cori
84f28085e90d   debian          "echo 'Hello World'"   15 minutes ago   Exited (0) 15 minutes ago               nervous_einstein

$ docker run -it --name cowsay --hostname cowsay debian bash
root@cowsay:/# apt-get update
Get:1 http://deb.debian.org/debian bullseye InRelease [116 kB]
[...]
root@cowsay:/# apt-get install -y cowsay fortune
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Note, selecting 'fortune-mod' instead of 'fortune'
[...]
root@cowsay:/# /usr/games/fortune | /usr/games/cowsay
 ________________________________________
/ You will obey or molten silver will be \
\ poured into your ears.                 /
 ----------------------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||
root@cowsay:/# 
<<up arrow> works to recall last command>
root@cowsay:/# /usr/games/fortune | /usr/games/cowsay
 _________________________________________
/ In a museum in Havana, there are two    \
| skulls of Christopher Columbus, "one    |
| when he was a boy and one when he was a |
| man."                                   |
|                                         |
\ -- Mark Twain                           /
 -----------------------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||
root@cowsay:/# exit

Removed fedora latest:
$ docker rm 0d9eb25de685
0d9eb25de685
$ docker ps -a
CONTAINER ID   IMAGE     COMMAND                CREATED          STATUS                      PORTS     NAMES
2453480e3c71   debian    "bash"                 10 minutes ago   Exited (0) 3 minutes ago              cowsay
377efb2742c9   debian    "/bin/bash"            26 minutes ago   Exited (0) 24 minutes ago             thirsty_cori
84f28085e90d   debian    "echo 'Hello World'"   27 minutes ago   Exited (0) 27 minutes ago             nervous_einstein

Leaving it there.  docker works fine with the update.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => tarazed25

Comment 5 Thomas Andrews 2022-03-05 00:05:42 CET

Back when I raised cattle I would have had to call in a veterinarian for this one. Its tail is broken in three places, and the switch hairs are missing. But then, perhaps it's a breed I'm not familiar with... 

Validating anyway.  ;)

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Comment 6 Len Lawrence 2022-03-05 00:09:51 CET

Moo!

Comment 7 Rolf Pedersen 2022-03-05 02:31:37 CET

(In reply to Len Lawrence from comment #6)
> Moo!
 _____ 
< moo >
 ----- 
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||
FIFY

CC: (none) => rolfpedersen

Dave Hodgins 2022-03-06 02:03:08 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 8 Mageia Robot 2022-03-06 11:41:34 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0088.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED