Bug 29527 - docker new security issues CVE-2021-41089 and CVE-2021-4109[12]
Summary: docker new security issues CVE-2021-41089 and CVE-2021-4109[12]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-10-04 21:43 CEST by David Walser
Modified: 2021-10-31 12:13 CET (History)
6 users (show)

See Also:
Source RPM: docker-20.10.5-1.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2021-10-04 21:43:41 CEST
Docker 20.10.9 has been released today (October 4), fixing security issues:
https://docs.docker.com/engine/release-notes/#20109

Two of the issues are in the Moby engine:
https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4
https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558

The last update we made to Docker 20.x is missing from Cauldron for some reason, but obviously it needs to be updated.

Mageia 8 is also affected.
David Walser 2021-10-04 21:43:58 CEST

Status comment: (none) => Fixed upstream in 20.10.9
Whiteboard: (none) => MGA8TOO

Comment 1 David Walser 2021-10-05 14:07:20 CEST
Ubuntu has issued an advisory for one of these issues on October 4:
https://ubuntu.com/security/notices/USN-5103-1
Comment 2 Marja Van Waes 2021-10-05 22:15:30 CEST
Assigning to the registered maintainer

CC: (none) => marja11
Assignee: bugsquad => bruno

Comment 3 Bruno Cornec 2021-10-12 01:55:39 CEST
docker 20.10.9 pushed to cauldron

Status: NEW => ASSIGNED

David Walser 2021-10-12 02:04:34 CEST

Version: Cauldron => 8
Whiteboard: MGA8TOO => (none)

Comment 4 David Walser 2021-10-12 23:28:02 CEST
SUSE has issued an advisory for this today (October 12):
https://lists.suse.com/pipermail/sle-security-updates/2021-October/009566.html
Comment 5 Bruno Cornec 2021-10-16 02:15:49 CEST
docker 20.10.9 pushed to mga8 updates_testing

Assignee: bruno => qa-bugs

Comment 6 David Walser 2021-10-16 19:42:46 CEST
docker-fish-completion-20.10.9-1.mga8
docker-nano-20.10.9-1.mga8
docker-zsh-completion-20.10.9-1.mga8
docker-logrotate-20.10.9-1.mga8
docker-20.10.9-1.mga8
docker-devel-20.10.9-1.mga8

from docker-20.10.9-1.mga8.src.rpm

Status comment: Fixed upstream in 20.10.9 => (none)
CC: (none) => bruno

Comment 7 Len Lawrence 2021-10-16 22:52:25 CEST
mga8, x64

Installed missing packages before updating.
# rpm -qa | grep docker
docker-containerd-1.5.7-1.mga8
docker-fish-completion-20.10.5-1.mga8
docker-zsh-completion-20.10.5-1.mga8
docker-logrotate-20.10.5-1.mga8
docker-nano-20.10.5-1.mga8
docker-20.10.5-1.mga8

docker-devel would not install.
# urpmi docker-devel
A requested package cannot be installed:
docker-devel-20.10.5-1.mga8.x86_64 (due to unsatisfied golang-ipath())

Continuing, but please note the failure.

After updates docker-devel was missing.
$ rpm -qa | grep docker
docker-20.10.9-1.mga8
docker-containerd-1.5.7-1.mga8
docker-zsh-completion-20.10.9-1.mga8
docker-fish-completion-20.10.9-1.mga8
docker-nano-20.10.9-1.mga8

$ sudo systemctl restart docker
$ docker run hello-world
Hello from Docker!
This message shows that your installation appears to be working correctly.
..............

Repeated tests similar to those on bug 29268, ignoring the moby fixes - no idea how to check those.  Removed several old images.
$ docker ps -a
CONTAINER ID   IMAGE           COMMAND       CREATED         STATUS                     PORTS     NAMES
5b03ae090d6e   hello-world     "/hello"      7 minutes ago   Exited (0) 7 minutes ago             agitated_kilby
c91b7bc8d5b2   fedora:latest   "bash"        3 hours ago     Exited (0) 3 hours ago               reverent_black
8be0163b7586   fedora:latest   "/bin/bash"   3 hours ago     Exited (0) 3 hours ago               nostalgic_hamilton
7a590701f872   ubuntu          "bash"        3 hours ago     Exited (0) 3 hours ago               beautiful_jepsen
4a976d45fb97   hello-world     "/hello"      3 hours ago     Exited (0) 3 hours ago               stupefied_blackburn

$ docker run -it fedora:latest zsh
docker: Error response from daemon: failed to create shim: OCI runtime create failed: container_linux.go:380: starting container process caused: exec: "zsh": executable file not found in $PATH: unknown.
ERRO[0000] error waiting for container: context canceled
$ docker run -it fedora:latest bash
[root@61f76f4e329d /]# apt-get zsh
bash: apt-get: command not found
[root@61f76f4e329d /]# dnf install zsh
Fedora 34 - x86_64                                                                               8.4 MB/s |  74 MB     00:08    
Fedora 34 openh264 (From Cisco) - x86_64                                                         1.8 kB/s | 2.5 kB     00:01    
................
[root@61f76f4e329d /]# zsh
[root@61f76f4e329d]/# ls -l lib64/libz<Tab>zstd<Tab>.so.1
libz.so.1@         libz.so.1.2.11*    libzck.so.1@       libzck.so.1.1.15*  libzstd.so.1@      libzstd.so.1.5.0*
lrwxrwxrwx 1 root root 16 May 16 20:01 lib64/libzstd.so.1 -> libzstd.so.1.5.0
[root@61f76f4e329d]/# exit
[root@61f76f4e329d /]# dnf install fish
......................
[root@61f76f4e329d /]# fish
Welcome to fish, the friendly interactive shell
Type help for instructions on how to use fish
<Everything in fish is colour coded>
<In the following line libsmart was automatically extended to libsmartcols.so.1
which was a complete softlink but tabbing presented alternative completions>
root@61f76f4e329d /#  ls -l lib64/libsmartcols.so.1 
…cols.so.1  …cols.so.1.1.0
<Typing . Tab completed the name>
-rwxr-xr-x 1 root root 107472 Feb 12  2021 lib64/libsmartcols.so.1.1.0
root@61f76f4e329d /# exit
[root@61f76f4e329d /]# dnf install nano
...................
[root@61f76f4e329d /]# nano
<It launches in the terminal>
^X
[root@61f76f4e329d /]# exit

In retrospect it strikes me that these last three tests may have been a waste of time.  Do we need a Mageia image with all the trimmings?  I cannot see the connection between the updates and the dnf installed applications.  Building such an image is way beyond my capabilities and the devel package is probably a necessity.

Apart from that docker is running smoothly at a simplistic level.
Would appreciate some guidance.

CC: (none) => tarazed25

Comment 8 Len Lawrence 2021-10-16 23:08:05 CEST
There seems to be a Mageia image.
$ docker run mageia:latest
Unable to find image 'mageia:latest' locally
latest: Pulling from library/mageia
2b7a6260b5e1: Pull complete 
Digest: sha256:ee8deeb5ab22773a38ee147c98127b2faa5edc72272beef5d497db44c4fda658
Status: Downloaded newer image for mageia:latest

Is it usable in this testing context?
Comment 9 Len Lawrence 2021-10-16 23:16:14 CEST
zsh and fish installed in the mageia container.
Go ahead with the tests?
Comment 10 David Walser 2021-10-17 00:01:34 CEST
Bruno, please see the dependency issue in Comment 7.  Things like this, and Len's other questions are why you need to leave yourself in CC when assigning to QA.

Keywords: (none) => feedback

Comment 11 Len Lawrence 2021-10-17 09:11:12 CEST
Thanks Dave.

@Bruno.  Been trying to work this out.  If the docker-*-completion modules are extensions to the docker service then they would likely be os agnostic.  In which case the earlier tests with the fedora image are valid.

That just leaves the devel package dependency problem.
Comment 12 Len Lawrence 2021-10-19 15:33:00 CEST
Ping!
I am pretty confident that the shell completion plugins are supposed to work with any distribution so these packages are all OK except for development.
Comment 13 David Walser 2021-10-19 16:07:30 CEST
Fedora has issued an advisory for this today (October 19):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/

Bruno, we still need to address the dependency issue in Comment 7.
Comment 14 Bruno Cornec 2021-10-20 10:34:22 CEST
Sorry, was pretty busy these last days, will look at it today
Comment 15 Bruno Cornec 2021-10-22 01:19:40 CEST
The problem is that this dependency is not an explicit one in the .psec, but something computed:
PECS/log.%{origname}:Requires: go-filesystem golang-ipath() libc.so.6()(64bit) libc.so.6(GLIBC_2.14)(64bit) libc.so.6(GLIBC_2.2.5)(64bit) libc.so.6(GLIBC_2.3)(64bit) libc.so.6(GLIBC_2.3.4)(64bit) libc.so.6(GLIBC_2.32)(64bit) libdevmapper.so.1.02()(64bit) libdevmapper.so.1.02(Base)(64bit) libdevmapper.so.1.02(DM_1_02_97)(64bit) libdl.so.2()(64bit) libdl.so.2(GLIBC_2.2.5)(64bit) libpthread.so.0()(64bit) libpthread.so.0(GLIBC_2.2.5)(64bit) libpthread.so.0(GLIBC_2.3.2)(64bit) libsystemd.so.0()(64bit) libsystemd.so.0(LIBSYSTEMD_209)(64bit)

And I have no idea on how to fix that sorry :-(
Comment 16 David Walser 2021-10-22 01:34:08 CEST
If it's a legitimate dependency, you need to import the package that provides it.  If it's not, you need to either do a _requires_exclude on the generated dependency or a _requires_exclude_from_file on the file where that dependency is coming from.
Comment 17 Bruno Cornec 2021-10-25 00:32:57 CEST
Sorry, I'm not a go programmer, and really can't be sure. If I look in the code I do not find a reference for any ipath call, so I wonder why its required. So I'll exclude it for now, hopping it's not a mistake.
Comment 18 Len Lawrence 2021-10-25 03:29:59 CEST
Not much on the web either.  Reading https://fedora.pkgs.org/33/fedora-x86_64/golang-github-docker-compose-on-kubernetes-cmd-controller-devel-0.4.25-2.alpha1.fc33.noarch.rpm.html
might indicate that golang-ipath is used in special circumstances so maybe we should just ignore it.
Comment 19 David Walser 2021-10-25 03:56:21 CEST
Well we can't just ignore it if it's not installable, but any solution that fixes that should be fine, especially as I don't believe anything requires (or BRs) docker-devel.
Comment 20 Len Lawrence 2021-10-25 09:46:23 CEST
Yes, I was agreeing that excluding golang-ipath seemed like a good idea.
Tried installing golang-opencensus-devel which pulled in 48 packages but still no golang-ipath.
Comment 21 Len Lawrence 2021-10-25 09:59:13 CEST
Still failing on golang-ipath.  Is the excluded version available yet?
Comment 22 Bruno Cornec 2021-10-25 12:16:43 CEST
It Wasn't as I wanted feedback. I'm just pushing it to updates_testing (and updated cauldron as well)
Comment 23 Len Lawrence 2021-10-25 12:38:30 CEST
Thanks Bruno.  Waiting for mirrors to sync.
Comment 24 Len Lawrence 2021-10-25 14:59:52 CEST
mirrorservice has not caught up with the whole set but these installed without a problem:
docker-20.10.9-3.mga8
docker-devel-20.10.9-3.mga8

Presumably the other packages will not have been affected apart from the new labels so do we have to re-test them?  Simply re-installing them should be sufficient?
Comment 25 Len Lawrence 2021-10-25 17:26:50 CEST
All packages updated.
docker-fish-completion-20.10.9-3.mga8
docker-zsh-completion-20.10.9-3.mga8
docker-nano-20.10.9-3.mga8
docker-20.10.9-3.mga8
docker-devel-20.10.9-3.mga8
docker-logrotate-20.10.9-3.mga8

docker restarted and running.
$ docker ps -a
CONTAINER ID   IMAGE           COMMAND       CREATED      STATUS                    PORTS     NAMES
57e1e97459b9   mageia:latest   "bash"        8 days ago   Exited (1) 44 hours ago             youthful_shannon
88f8321c5926   mageia:latest   "zsh"         8 days ago   Created                             awesome_easley
73cb1a30bba0   mageia:latest   "/bin/bash"   8 days ago   Exited (0) 8 days ago               funny_allen
61f76f4e329d   fedora:latest   "bash"        8 days ago   Exited (0) 8 days ago               funny_cori
.............

Whiteboard: (none) => MGA8-64-OK

Comment 26 Len Lawrence 2021-10-26 00:25:38 CEST
OK to remove feedback?

Keywords: feedback => (none)

Comment 27 David Walser 2021-10-26 00:26:36 CEST
Yes indeed.
Comment 28 Bruno Cornec 2021-10-27 11:44:36 CEST
Seems good to go no ?
Comment 29 Len Lawrence 2021-10-27 14:11:31 CEST
Yes, I would say so.
Comment 30 Thomas Andrews 2021-10-27 22:12:17 CEST
Thank you, Gentlemen. Validating. 

Bruno, it would be a big help if you could write a suggested advisory, putting all this information together.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 31 Dave Hodgins 2021-10-29 18:57:33 CEST
Still need an advisory. See bug 29582, comment 2 for an example of what's
expected to be provided to qa.

The list of packages is included to ensure we know what to test. The list of
issues (cve and bug fixes) so we know what to look for having been changed by
the update.

CC: (none) => davidwhodgins

Thomas Backlund 2021-10-31 11:06:35 CET

Keywords: (none) => advisory

Comment 32 Mageia Robot 2021-10-31 12:13:46 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0500.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.