Bug 34145 - docker-containerd new security issue CVE-2024-40635
Summary: docker-containerd new security issue CVE-2024-40635
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-03-31 16:45 CEST by Nicolas Salguero
Modified: 2025-04-10 02:23 CEST (History)
2 users (show)

See Also:
Source RPM: docker-containerd-1.7.3-1.mga10.src.rpm, docker-containerd-1.7.3-1.mga9.src.rpm
CVE: CVE-2024-40635
Status comment: Fixed upstream in 1.7.27 and patch available from upstream


Attachments

Comment 1 Nicolas Salguero 2025-03-31 16:47:24 CEST
Fix: https://github.com/containerd/containerd/commit/11504c3fc5f45634f2d93d57743a998194430b82

Source RPM: (none) => docker-containerd-1.7.3-1.mga10.src.rpm, docker-containerd-1.7.3-1.mga9.src.rpm
CVE: (none) => CVE-2024-40635
Status comment: (none) => Fixed upstream in 1.7.27 and patch available from upstream
Whiteboard: (none) => MGA9TOO

Comment 2 Lewis Smith 2025-04-04 10:00:37 CEST
Thanks for the patch URL.

Assigning to Bruno who normally updates docker.

Assignee: bugsquad => bruno

Comment 3 Bruno Cornec 2025-04-07 00:34:45 CEST
1.7.27 on its way to into updates_testing fir mageia 9:

SRPMS/docker-containerd-1.7.27-1.mga9.src.rpm
RPMS/x86_64/docker-containerd-1.7.27-1.mga9.x86_64.rpm

Status: NEW => ASSIGNED

Comment 4 Bruno Cornec 2025-04-07 00:40:19 CEST
Similary build for cauldron. Will update to latest stable 2.0.4 once I've been able to test it.

Assignee: bruno => qa-bugs

katnatek 2025-04-07 18:22:57 CEST

Whiteboard: MGA9TOO => (none)
Keywords: (none) => advisory
Version: Cauldron => 9

Comment 5 katnatek 2025-04-09 00:46:41 CEST
RH x86_64

LC_ALL=C urpmi docker-containerd
To satisfy dependencies, the following packages are going to be installed:
  Package                        Version      Release       Arch    
(medium "QA Testing (64-bit)")
  docker-containerd              1.7.27       1.mga9        x86_64  
(medium "Core Updates")
  opencontainers-runc            1.1.14       1.mga9        x86_64  
144MB of additional disk space will be used.
38MB of packages will be retrieved.
Proceed with the installation of the 2 packages? (Y/n) y


    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/opencontainers-runc-1.1.14-1.mga9.x86_64.rpm
installing //home/katnatek/qa-testing/x86_64/docker-containerd-1.7.27-1.mga9.x86_64.rpm                                             
/var/cache/urpmi/rpms/opencontainers-runc-1.1.14-1.mga9.x86_64.rpm
Preparing...                     ##################################################################################################
      1/2: opencontainers-runc   ##################################################################################################
      2/2: docker-containerd     ##################################################################################################

Looking for test find bug#31268 comment#22, not apply now

systemctl start docker
Failed to start docker.service: Unit docker.service not found

urpmq --whatrequires docker-containerd|uniq
docker
docker-containerd


But I find other docker packages in testing

docker-25.0.7-1.mga9.x86_64.rpm
docker-containerd-1.7.27-1.mga9.x86_64.rpm
docker-devel-25.0.7-1.mga9.x86_64.rpm
docker-fish-completion-25.0.7-1.mga9.x86_64.rpm
docker-logrotate-25.0.7-1.mga9.x86_64.rpm
docker-nano-25.0.7-1.mga9.x86_64.rpm
docker-zsh-completion-25.0.7-1.mga9.x86_64.rpm


SRPM:
docker-25.0.7-1.mga9.src.rpm
docker-containerd-1.7.27-1.mga9.src.rpm

Should be included in this bug ?
katnatek 2025-04-09 00:47:00 CEST

Keywords: (none) => feedback

Comment 6 katnatek 2025-04-09 01:06:32 CEST
RH x86_64

 docker run hello-world
docker: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?.
See 'docker run --help'.

urpmf docker.service
docker:/usr/lib/systemd/system/docker.service

systemctl start docker.service
systemctl status docker
● docker.service - Docker Application Container Engine
     Loaded: loaded (/usr/lib/systemd/system/docker.service; disabled; preset: disabled)
     Active: active (running) since Tue 2025-04-08 16:53:37 CST; 2min 53s ago
       Docs: http://docs.docker.com
    Process: 36991 ExecStartPre=/usr/sbin/docker-network-cleanup (code=exited, status=0/SUCCESS)
   Main PID: 36994 (dockerd)
      Tasks: 20
     Memory: 72.1M
        CPU: 743ms
     CGroup: /system.slice/docker.service
             ├─36994 /usr/sbin/dockerd --data-root /var/cache/docker -H unix:///var/run/docker.sock -H tcp://127.0.0.1:2375
             └─37006 containerd --config /var/run/docker/containerd/containerd.toml

abr 08 16:53:34 jgrey.phoenix dockerd[36994]: time="2025-04-08T16:53:34.813784351-06:00" level=info msg="[graphdriver] using prior s>
abr 08 16:53:35 jgrey.phoenix dockerd[36994]: time="2025-04-08T16:53:35.072005609-06:00" level=info msg="Loading containers: start."
abr 08 16:53:35 jgrey.phoenix dockerd[36994]: time="2025-04-08T16:53:35.958180203-06:00" level=info msg="Default bridge (docker0) is>
abr 08 16:53:36 jgrey.phoenix dockerd[36994]: time="2025-04-08T16:53:36.102881353-06:00" level=info msg="Loading containers: done."
abr 08 16:53:36 jgrey.phoenix dockerd[36994]: time="2025-04-08T16:53:36.385236821-06:00" level=warning msg="WARNING: API is accessib>
abr 08 16:53:36 jgrey.phoenix dockerd[36994]: time="2025-04-08T16:53:36.385296517-06:00" level=info msg="Docker daemon" commit=libra>
abr 08 16:53:36 jgrey.phoenix dockerd[36994]: time="2025-04-08T16:53:36.396948791-06:00" level=info msg="Daemon has completed initia>
abr 08 16:53:37 jgrey.phoenix dockerd[36994]: time="2025-04-08T16:53:37.453047181-06:00" level=info msg="API listen on /var/run/dock>
abr 08 16:53:37 jgrey.phoenix dockerd[36994]: time="2025-04-08T16:53:37.453060924-06:00" level=info msg="API listen on 127.0.0.1:237>
abr 08 16:53:37 jgrey.phoenix systemd[1]: Started docker.service.



Add me to docker group , close and start session

docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
e6590344b1a5: Pull complete 
Digest: sha256:7e1a4e2d11e2ac7a8c3f768d4166c2defeb09d2a750b010412b6ea13de1efb19
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

docker ps -a
CONTAINER ID   IMAGE          COMMAND                  CREATED         STATUS                     PORTS     NAMES
5f2f23db1410   hello-world    "/hello"                 4 minutes ago   Exited (0) 4 minutes ago             ecstatic_ganguly
088936b0ce6c   mariadb        "docker-entrypoint.s…"   12 months ago   Exited (0) 12 months ago             tmp-db-1
7e8c9b684507   b8bba28b797b   "docker-entrypoint.s…"   13 months ago   Exited (0) 13 months ago             docker-db-1

Assuming the other docker packages in testing will fix other bug I give this OK

Keywords: feedback => (none)
Whiteboard: (none) => MGA9-64-OK

Comment 7 Thomas Andrews 2025-04-09 16:38:26 CEST
Looks to me like those docker 25 packages are probably for Bug 33870, but for whatever reason they are not yet ready for us.

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 8 Mageia Robot 2025-04-10 02:23:54 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0130.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.