Moderate: runc security update
Summary
ALSA-2023:7763: Moderate: runc security update. Affects runc versions < 4:1.1.9-2.el9_3. Fixed in 4:1.1.9-2.el9_3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. It is used to create and run containers on various platforms. The tool is widely adopted in the industry due to its simplicity and compatibility with different container formats.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the runC tool:
-
CVE-2023-29409: This vulnerability in the golang crypto/tls library allows for slow verification of certificate chains containing large RSA keys. An attacker could exploit this to perform a denial-of-service attack or potentially bypass certificate validation.
-
CVE-2023-39321: The golang crypto/tls library panics when processing post-handshake messages on QUIC connections. An attacker could potentially trigger this panic to disrupt the functioning of the application.
-
CVE-2023-39322: The golang crypto/tls library lacks a limit on buffered post-handshake messages, which can lead to excessive memory consumption. An attacker could exploit this to exhaust system resources and cause a denial-of-service condition.
How To Fix
Minimum fixed version
4:1.1.9-2.el9_3
This is the first release that contains the fix.
sudo dnf update runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, this security update addresses multiple vulnerabilities in the runC tool. It is recommended to update the runc package to the latest version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for runc →
FAQ
runC is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. It allows users to create and run containers on various platforms.
This update addresses three vulnerabilities: CVE-2023-29409, CVE-2023-39321, and CVE-2023-39322. These vulnerabilities involve issues in the golang crypto/tls library used by runC.
The impact of these vulnerabilities can vary. CVE-2023-29409 could lead to a denial-of-service attack or bypass of certificate validation. CVE-2023-39321 could cause application disruptions, and CVE-2023-39322 could result in excessive memory consumption and denial-of-service conditions.
To fix these vulnerabilities, update the runc package to version 4:1.1.9-2.el9_3 or later. This update includes the necessary patches to address the security issues.
You can find more information about these vulnerabilities in the Common Vulnerabilities and Exposures (CVE) database. The CVE identifiers are CVE-2023-29409, CVE-2023-39321, and CVE-2023-39322.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
