Security update for containerd, docker, runc

Announcement ID:	SUSE-SU-2021:1954-1
Rating:	important
References:	bsc#1168481 bsc#1175081 bsc#1175821 bsc#1181594 bsc#1181641 bsc#1181677 bsc#1181730 bsc#1181732 bsc#1181749 bsc#1182451 bsc#1182476 bsc#1182947 bsc#1183024 bsc#1183855 bsc#1184768 bsc#1184962 bsc#1185405
Cross-References:	CVE-2021-21284 CVE-2021-21285 CVE-2021-21334 CVE-2021-30465
CVSS scores:	CVE-2021-21284 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N CVE-2021-21284 ( NVD ): 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVE-2021-21285 ( SUSE ): 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CVE-2021-21285 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-21334 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-21334 ( NVD ): 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-30465 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-30465 ( NVD ): 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products:	Containers Module 15-SP2 Containers Module 15-SP3 SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15 LTSS 15 SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1 ESPOS 15-SP1 SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15 LTSS 15 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 SUSE Linux Enterprise Server ESPOS 15 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Manager Proxy 4.0 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.0 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.0 SUSE Manager Server 4.1 SUSE Manager Server 4.2

An update that solves four vulnerabilities and has 13 security fixes can now be installed.

Description:

This update for containerd, docker, runc fixes the following issues:

Docker was updated to 20.10.6-ce (bsc#1184768, bsc#1182947, bsc#1181594)

• Switch version to use -ce suffix rather than _ce to avoid confusing other tools (bsc#1182476).
• CVE-2021-21284: Fixed a potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732)
• CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest crashes the dockerd daemon (bsc#1181730).
• btrfs quotas being removed by Docker regularly (bsc#1183855, bsc#1175081)

runc was updated to v1.0.0~rc93 (bsc#1182451, bsc#1175821 bsc#1184962).

• Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).
• Fixed /dev/null is not available (bsc#1168481).
• CVE-2021-30465: Fixed a symlink-exchange attack vulnarability (bsc#1185405).

containerd was updated to v1.4.4

• CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).
• Handle a requirement from docker (bsc#1181594).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Containers Module 15-SP2
  zypper in -t patch SUSE-SLE-Module-Containers-15-SP2-2021-1954=1
• Containers Module 15-SP3
  zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2021-1954=1
• SUSE Linux Enterprise Server ESPOS 15
  zypper in -t patch SUSE-SLE-Product-HPC-15-2021-1954=1
• SUSE Linux Enterprise High Performance Computing 15 LTSS 15
  zypper in -t patch SUSE-SLE-Product-HPC-15-2021-1954=1
• SUSE Linux Enterprise High Performance Computing 15 SP1 ESPOS 15-SP1
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2021-1954=1
• SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2021-1954=1
• SUSE Linux Enterprise Server 15 LTSS 15
  zypper in -t patch SUSE-SLE-Product-SLES-15-2021-1954=1
• SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2021-1954=1
• SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2021-1954=1
• SUSE Linux Enterprise Server for SAP Applications 15
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2021-1954=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP1
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2021-1954=1
• SUSE Manager Proxy 4.0
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.0-2021-1954=1
• SUSE Manager Retail Branch Server 4.0
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.0-2021-1954=1
• SUSE Manager Server 4.0
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.0-2021-1954=1
• SUSE Enterprise Storage 6
  zypper in -t patch SUSE-Storage-6-2021-1954=1
• SUSE Enterprise Storage 7
  zypper in -t patch SUSE-Storage-7-2021-1954=1
• SUSE CaaS Platform 4.0
  To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way.
• SUSE Linux Enterprise Micro 5.0
  zypper in -t patch SUSE-SUSE-MicroOS-5.0-2021-1954=1

Package List:

• Containers Module 15-SP2 (aarch64 ppc64le s390x x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• Containers Module 15-SP2 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• Containers Module 15-SP3 (aarch64 ppc64le s390x x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• Containers Module 15-SP3 (noarch)
  • docker-fish-completion-20.10.6_ce-6.49.3
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server ESPOS 15 (x86_64)
  • docker-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-debuginfo-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server ESPOS 15 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Linux Enterprise High Performance Computing 15 LTSS 15 (x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Linux Enterprise High Performance Computing 15 LTSS 15 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Linux Enterprise High Performance Computing 15 SP1 ESPOS 15-SP1 (aarch64 x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Linux Enterprise High Performance Computing 15 SP1 ESPOS 15-SP1 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (aarch64 x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server 15 LTSS 15 (ppc64le s390x x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server 15 LTSS 15 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 (x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (aarch64 ppc64le s390x x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server for SAP Applications 15 (ppc64le x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server for SAP Applications 15 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Server for SAP Applications 15 SP1 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Manager Proxy 4.0 (x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Manager Proxy 4.0 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Manager Retail Branch Server 4.0 (x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Manager Retail Branch Server 4.0 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Manager Server 4.0 (ppc64le s390x x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Manager Server 4.0 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Enterprise Storage 6 (aarch64 x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE Enterprise Storage 6 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Enterprise Storage 7 (aarch64 x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
• SUSE CaaS Platform 4.0 (x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3
• SUSE CaaS Platform 4.0 (noarch)
  • docker-bash-completion-20.10.6_ce-6.49.3
• SUSE Linux Enterprise Micro 5.0 (aarch64 x86_64)
  • runc-debuginfo-1.0.0~rc93-1.14.2
  • runc-1.0.0~rc93-1.14.2
  • docker-debuginfo-20.10.6_ce-6.49.3
  • containerd-1.4.4-5.32.1
  • docker-20.10.6_ce-6.49.3

References:

• https://www.suse.com/security/cve/CVE-2021-21284.html
• https://www.suse.com/security/cve/CVE-2021-21285.html
• https://www.suse.com/security/cve/CVE-2021-21334.html
• https://www.suse.com/security/cve/CVE-2021-30465.html
• https://bugzilla.suse.com/show_bug.cgi?id=1168481
• https://bugzilla.suse.com/show_bug.cgi?id=1175081
• https://bugzilla.suse.com/show_bug.cgi?id=1175821
• https://bugzilla.suse.com/show_bug.cgi?id=1181594
• https://bugzilla.suse.com/show_bug.cgi?id=1181641
• https://bugzilla.suse.com/show_bug.cgi?id=1181677
• https://bugzilla.suse.com/show_bug.cgi?id=1181730
• https://bugzilla.suse.com/show_bug.cgi?id=1181732
• https://bugzilla.suse.com/show_bug.cgi?id=1181749
• https://bugzilla.suse.com/show_bug.cgi?id=1182451
• https://bugzilla.suse.com/show_bug.cgi?id=1182476
• https://bugzilla.suse.com/show_bug.cgi?id=1182947
• https://bugzilla.suse.com/show_bug.cgi?id=1183024
• https://bugzilla.suse.com/show_bug.cgi?id=1183855
• https://bugzilla.suse.com/show_bug.cgi?id=1184768
• https://bugzilla.suse.com/show_bug.cgi?id=1184962
• https://bugzilla.suse.com/show_bug.cgi?id=1185405