mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-19 16:40:46 -09:00
52976c54f7
This is the fifth patch release in the 1.1.z series of runc, which fixes three CVEs found in runc. CVE-2023-25809 is a vulnerability involving rootless containers where (under specific configurations), the container would have write access to the /sys/fs/cgroup/user.slice/... cgroup hierarchy. No other hierarchies on the host were affected. This vulnerability was discovered by Akihiro Suda. GHSA-m8cg-xc2p-r3fc CVE-2023-27561 was a regression which effectively re-introduced CVE-2019-19921. This bug was present from v1.0.0-rc95 to v1.1.4. This regression was discovered by Beuc. GHSA-vpvm-3wq2-2wvm CVE-2023-28642 is a variant of CVE-2023-27561 and was fixed by the same patch. This variant of the above vulnerability was reported by Lei Wang. GHSA-g2j6-57v7-gm8c In addition, the following other fixes are included in this release: - Fix the inability to use /dev/null when inside a container - Fix changing the ownership of host's /dev/null caused by fd redirection - Fix rare runc exec/enter unshare error on older kernels, including CentOS < 7.7 - nsexec: Check for errors in write_log() https://github.com/opencontainers/runc/releases/tag/v1.1.5 Signed-off-by: Christian Stewart <christian@paral.in> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
31 lines
786 B
Makefile
31 lines
786 B
Makefile
################################################################################
|
|
#
|
|
# runc
|
|
#
|
|
################################################################################
|
|
|
|
RUNC_VERSION = 1.1.5
|
|
RUNC_SITE = $(call github,opencontainers,runc,v$(RUNC_VERSION))
|
|
RUNC_LICENSE = Apache-2.0, LGPL-2.1 (libseccomp)
|
|
RUNC_LICENSE_FILES = LICENSE
|
|
RUNC_CPE_ID_VENDOR = linuxfoundation
|
|
|
|
RUNC_LDFLAGS = -X main.version=$(RUNC_VERSION)
|
|
RUNC_TAGS = cgo static_build
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBAPPARMOR),y)
|
|
RUNC_DEPENDENCIES += libapparmor
|
|
RUNC_TAGS += apparmor
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSECCOMP),y)
|
|
RUNC_TAGS += seccomp
|
|
RUNC_DEPENDENCIES += libseccomp host-pkgconf
|
|
endif
|
|
|
|
HOST_RUNC_LDFLAGS = $(RUNC_LDFLAGS)
|
|
HOST_RUNC_TAGS = cgo static_build
|
|
|
|
$(eval $(golang-package))
|
|
$(eval $(host-golang-package))
|