Bugzilla – Bug 1160452
VUL-0: CVE-2019-19921: runc: volume mount race condition with shared mounts
Last modified: 2024-07-22 13:50:40 UTC
CVE-2019-19921 [Volume mount race condition with shared mounts] References: https://github.com/opencontainers/runc/issues/2197 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19921 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19921.html
I've been bouncing between different prior engagements so I only just had a change to submit an upstream fix for the issue[1] and submit it to openSUSE. Unfortunately I'm at a conference (without my work laptop) so I cannot submit the same patch to IBS -- feel free to just do a direct submit-request from openSUSE.org:Virtualization:containers/docker-runc to SLE-15 and SLE-12.
(In reply to Aleksa Sarai from comment #1) > I've been bouncing between different prior engagements so I only just had a > change to submit an upstream fix for the issue[1] and submit it to openSUSE. > Unfortunately I'm at a conference (without my work laptop) so I cannot > submit the same patch to IBS -- feel free to just do a direct submit-request > from openSUSE.org:Virtualization:containers/docker-runc to SLE-15 and SLE-12. [1]: https://github.com/opencontainers/runc/pull/2207
Did 2 MRs for SLE 12 and 15 - https://build.suse.de/request/show/209391 - https://build.suse.de/request/show/209392
The upstream PR has been modified (namely, error out if there is an attack in progress rather than mitigating it). I've submitted new versions of the openSUSE SRs and SLE MRs.
SUSE-SU-2020:0375-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1160452 CVE References: CVE-2019-19921 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): docker-runc-kubic-1.0.0rc8+gitr3917_3e425f80a8c9-6.32.1 SUSE Linux Enterprise Module for Containers 15-SP1 (src): docker-runc-1.0.0rc8+gitr3917_3e425f80a8c9-6.32.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:0376-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1160452 CVE References: CVE-2019-19921 Sources used: SUSE Linux Enterprise Module for Containers 12 (src): docker-runc-1.0.0rc8+gitr3917_3e425f80a8c9-1.40.1 SUSE CaaS Platform 3.0 (src): docker-runc-kubic-1.0.0rc8+gitr3917_3e425f80a8c9-1.40.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:0219-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1160452 CVE References: CVE-2019-19921 Sources used: openSUSE Leap 15.1 (src): docker-runc-1.0.0rc8+gitr3917_3e425f80a8c9-lp151.3.15.1
SUSE-SU-2020:0944-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1149954,1160452 CVE References: CVE-2019-19921 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): runc-1.0.0~rc10-1.9.1 SUSE Linux Enterprise Module for Containers 15-SP1 (src): runc-1.0.0~rc10-1.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1458-1: An update that solves 9 vulnerabilities and has 23 fixes is now available. Category: security (important) Bug References: 1028638,1034053,1048046,1051429,1053532,1095817,1118897,1118898,1118899,1121967,1131314,1131553,1149954,1152308,1160452,1168481,1175081,1175821,1181594,1181641,1181677,1181730,1181732,1181749,1182451,1182476,1182947,1183024,1183397,1183855,1184768,1184962 CVE References: CVE-2018-16873,CVE-2018-16874,CVE-2018-16875,CVE-2019-16884,CVE-2019-19921,CVE-2019-5736,CVE-2021-21284,CVE-2021-21285,CVE-2021-21334 JIRA References: Sources used: SUSE Linux Enterprise Module for Containers 12 (src): containerd-1.4.4-16.38.1, docker-20.10.6_ce-98.66.1, runc-1.0.0~rc93-16.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Upstream found a regression for the CVE-2019-19921 fix that was introduced by the fix for CVE-2021-30465. This is tracked under CVE-2023-27561 here: https://bugzilla.suse.com/show_bug.cgi?id=1208962
This has been fixed.