Hello community, here is the log from the commit of package runc for openSUSE:Factory checked in at 2020-01-23 16:07:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/runc (Old) and /work/SRC/openSUSE:Factory/.runc.new.26092 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "runc" Thu Jan 23 16:07:57 2020 rev:26 rq:765105 version:1.0.0~rc9 Changes: -------- --- /work/SRC/openSUSE:Factory/runc/runc.changes 2020-01-16 18:19:51.960928151 +0100 +++ /work/SRC/openSUSE:Factory/.runc.new.26092/runc.changes 2020-01-23 16:08:00.959532798 +0100 @@ -1,0 +2,6 @@ +Fri Jan 17 03:02:46 UTC 2020 - Aleksa Sarai <[email protected]> + +- Update CVE-2019-19921 patch to match upstream PR. + * CVE-2019-19921.patch + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ CVE-2019-19921.patch ++++++ --- /var/tmp/diff_new_pack.NWPweF/_old 2020-01-23 16:08:02.743533855 +0100 +++ /var/tmp/diff_new_pack.NWPweF/_new 2020-01-23 16:08:02.771533872 +0100 @@ -1,4 +1,4 @@ -From 9975f5238a792586bfa3e36e4c66a8d1154b44ac Mon Sep 17 00:00:00 2001 +From 3291d66b98445bd7f7d02eac7f2bca2ac2c56942 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai <[email protected]> Date: Sat, 21 Dec 2019 23:40:17 +1100 Subject: [PATCH] rootfs: do not permit /proc mounts to non-directories @@ -17,19 +17,19 @@ Fixes: CVE-2019-19921 Signed-off-by: Aleksa Sarai <[email protected]> --- - libcontainer/rootfs_linux.go | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) + libcontainer/rootfs_linux.go | 12 ++++++++++++ + 1 file changed, 12 insertions(+) diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go -index 291021440a1a..6bc0747f9f7e 100644 +index 291021440a1a..106c4c2b98bf 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go -@@ -299,6 +299,20 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string, enableCgroupns b +@@ -299,6 +299,18 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string, enableCgroupns b switch m.Device { case "proc", "sysfs": -+ // If the destination already exists and is not a directory, we remove -+ // it. This is to avoid mounting through a symlink or similar -- which ++ // If the destination already exists and is not a directory, we bail ++ // out This is to avoid mounting through a symlink or similar -- which + // has been a "fun" attack scenario in the past. + // TODO: This won't be necessary once we switch to libpathrs and we can + // stop all of these symlink-exchange attacks. @@ -38,9 +38,7 @@ + return err + } + } else if fi.Mode()&os.ModeDir == 0 { -+ if err := os.Remove(dest); err != nil { -+ return err -+ } ++ return fmt.Errorf("filesystem %q must be mounted on ordinary directory", m.Device) + } if err := os.MkdirAll(dest, 0755); err != nil { return err
