Security update for containerd, docker, runc

Announcement ID: SUSE-SU-2017:1964-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2016-9962 ( NVD ): 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • Containers Module 12
  • SUSE Linux Enterprise High Performance Computing 12 SP2
  • SUSE Linux Enterprise High Performance Computing 12 SP3
  • SUSE Linux Enterprise High Performance Computing 12 SP4
  • SUSE Linux Enterprise High Performance Computing 12 SP5
  • SUSE Linux Enterprise Server 12
  • SUSE Linux Enterprise Server 12 SP1
  • SUSE Linux Enterprise Server 12 SP2
  • SUSE Linux Enterprise Server 12 SP3
  • SUSE Linux Enterprise Server 12 SP4
  • SUSE Linux Enterprise Server 12 SP5
  • SUSE Linux Enterprise Server for SAP Applications 12
  • SUSE Linux Enterprise Server for SAP Applications 12 SP1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP2
  • SUSE Linux Enterprise Server for SAP Applications 12 SP3
  • SUSE Linux Enterprise Server for SAP Applications 12 SP4
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5
  • SUSE OpenStack Cloud 6

An update that solves one vulnerability and has one security fix can now be installed.

Description:

This update for - containerd - docker to 1.12.6 - runc fixes the two issues.

This security issue was fixed:

  • CVE-2016-9962: A difficult to exploit race condition caused by passing a file descriptor from the host's filesystem into the container could have allowed the guest to escape(bsc#1012568).

For docker this non-security issue was fixed:

  • bsc#1019251: Waiting when starting the docker service

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE OpenStack Cloud 6
    zypper in -t patch SUSE-OpenStack-Cloud-6-2017-201=1
  • Containers Module 12
    zypper in -t patch SUSE-SLE-Module-Containers-12-2017-201=1

Package List:

  • SUSE OpenStack Cloud 6 (x86_64)
    • containerd-debuginfo-0.2.5+gitr569_2a5e70c-15.3
    • docker-debugsource-1.12.6-87.2
    • runc-0.1.1+gitr2819_50a19c6-15.2
    • docker-debuginfo-1.12.6-87.2
    • containerd-debugsource-0.2.5+gitr569_2a5e70c-15.3
    • runc-debuginfo-0.1.1+gitr2819_50a19c6-15.2
    • runc-debugsource-0.1.1+gitr2819_50a19c6-15.2
    • docker-1.12.6-87.2
    • containerd-0.2.5+gitr569_2a5e70c-15.3
  • Containers Module 12 (ppc64le s390x x86_64)
    • containerd-debuginfo-0.2.5+gitr569_2a5e70c-15.3
    • docker-debugsource-1.12.6-87.2
    • runc-0.1.1+gitr2819_50a19c6-15.2
    • docker-debuginfo-1.12.6-87.2
    • containerd-debugsource-0.2.5+gitr569_2a5e70c-15.3
    • runc-debuginfo-0.1.1+gitr2819_50a19c6-15.2
    • runc-debugsource-0.1.1+gitr2819_50a19c6-15.2
    • docker-1.12.6-87.2
    • containerd-0.2.5+gitr569_2a5e70c-15.3

References: