Security update for crun SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:0074-1 Final 1 1 2025-02-24T15:01:42Z current 2025-02-24T15:01:42Z 2025-02-24T15:01:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for crun This update for crun fixes the following issues: Update to 1.20: * krun: fix CVE-2025-24965. The .krun_config.json file could be created outside of the container rootfs. (bsc#1237421) * cgroup: reverted the removal of tun/tap from the default allow list, this was done in crun-1.5. The tun/tap device is now added by default again. * CRIU: do not set network_lock unless explicitly specified. * status: disallow container names containing slashes in their name. * linux: Improved error message when failing to set the net.ipv4.ping_group_range sysctl. * scheduler: Ignore ENOSYS errors when resetting the CPU affinity mask. * linux: return a better error message when pidfd_open fails with EINVAL. * cgroup: display the absolute path to cgroup.controllers when a controller is unavailable. * exec: always call setsid. Now processes created through exec get the correct process group id. Update to 1.19.1: * linux: fix a hang if there are no reads from the tty. Use non blocking sockets to read and write from the tty so that the 'crun exec' process doesn't hang when the terminal is not consuming any data. * linux: remove the workaround needed to mount a cgroup on top of another cgroup mount. The workaround had the disadvantage to temporarily leak a mount on the host. The alternative that is currently used is to mount a temporary tmpfs between the twoo cgroup mounts. Update to 1.19: * wasm: add new handler wamr. * criu: allow passing network lock method to libcriu. * linux: honor exec cpu affinity mask. * build: fix build with musl libc. * crun: use mount API to self-clone. * cgroup, systemd: do not override devices on update. If the 'update' request has no device block configured, do not reset the previously configuration. * cgroup: handle case where cgroup v1 freezer is disabled. On systems without the freezer controller, containers were mistakenly reported as paused. * cgroup: do not stop process on exec. The cpu mask is configured on the systemd scope, the previous workaround to stop the container until the cgroup is fully configured is no longer needed. - Update to crun v1.18.2 Upstream changelog is available from <https://github.com/containers/crun/releases/tag/1.18.2> - Update to crun v1.18. Upstream changelog is available from <https://github.com/containers/crun/releases/tag/1.18> Update to 1.17: * Add --log-level option. It accepts error, warning and error. * Add debug logs for container creation. * Fix double-free in crun exec code that could lead to a crash. * Allow passing an ID to the journald log driver. * Report 'executable not found' errors after tty has been setup. * Do not treat EPIPE from hooks as an error. * Make sure DefaultDependencies is correctly set in the systemd scope. * Improve the error message when the container process is not found. * Improve error handling for the mnt namespace restoration. * Fix error handling for getpwuid_r, recvfrom and libcrun_kill_linux. * Fix handling of device paths with trailing slashes. - add url for keyring - enable leap by disabling wasmedge (not packaged for leap) Upstream release 1.16.1: - fix a regression introduced by 1.16 where using 'rshared' rootfs mount propagation and the rootfs itself is a mountpoint. - inherit user from original process on exec, if not overridden. Update to 1.16: - build: fix build for s390x. - linux: fix mount of special files with rro. Open the mount target with O_PATH to prevent open(2) failures with special files like FIFOs or UNIX sockets. - Fix sd-bus error handling for cpu quota and period props update. - container: use relative path for rootfs if possible. If the rootfs cannot be resolved and it is below the current working directory, only use its relative path. - wasmedge: access container environment variables for the WasmEdge configuration. - cgroup, systemd: use MemoryMax instead of MemoryLimit. Fixes a warning for using an old configuration name. - cgroup, systemd: improve checks for sd_bus_message_append errors New upstream release 1.15: * fix a mount point leak under /run/crun, add a retry mechanism to unmount the directory if the removal failed with EBUSY. * linux: cgroups: fix potential mount leak when /sys/fs/cgroup is already mounted, causing the posthooks to not run. * release: build s390x binaries using musl libc. * features: add support for potentiallyUnsafeConfigAnnotations. * handlers: add option to load wasi-nn plugin for wasmedge. * linux: fix 'harden chdir()' security measure. The previous check was not correct. * crun: add option --keep to the run command. When specified the container is not automatically deleted when it exits. New upstream release 1.14.4: - linux: fix mount of file with recursive flags. Do not assume it is a directory, but check the source type. - follow up for 1.14.2. Drop the version check for each command. - crun: drop check for OCI version. A recent bump in the OCI runtime specs caused crun to fail with every config file. Just drop the check since it doesn't add any value. - there was recently a security vulnerability (CVE-2024-21626) in runc that allowed a malicious user to chdir(2) to a /proc/*/fd entry that is outside the container rootfs. While crun is not affected directly, harden chdir by validating that we are still inside the container rootfs. - container: attempt to close all the files before execv(2). if we leak any fd, it prevents execv to gain access to files outside the container rootfs through /proc/self/fd/$fd. - fix a regression caused by 1.14 when installing the ebpf filter on a kernel older than 5.11. - cgroup, systemd: fix segfault if the resources block is not specified. Update to 1.14: * build: drop dependency on libgcrypt. Use blake3 to compute the cache key. * cpuset: don't clobber parent cgroup value when writing the cpuset value. * linux: force umask(0). It ensures that the mknodat syscall is not affected by the umask of the calling process, allowing file permissions to be set as specified in the OCI configuration. * ebpf: do not require MEMLOCK for eBPF programs. This requirement was relaxed in Linux 5.11. - update to 1.13: * src: use O_CLOEXEC for all open/openat calls * cgroup v1: use 'max' when pids limit < 0. * improve error message when idmap mount fails because the underlying file system has no support for it. * libcrun: fix compilation when building without libseccomp and libcap. * fix relative idmapped mount when using the custom annotation. - New upstream release 1.12: * add new WebAssembly handler: spin. * systemd: fallback to system bus if session bus is not available. * configure the cpu rt and cpuset controllers before joining them to avoid running temporarily the workload on the wrong cpus. * preconfigure the cpuset with required resources instead of using the parent's set. This prevents needless churn in the kernel as it tracks which CPUs have load balancing disabled. * try attr/<lsm>/* before the attr/* files. Writes to the attr/* files may fail if apparmor is not the first 'major' LSM in the list of loaded LSMs (e.g. lsm=apparmor,bpf vs lsm=bpf,apparmor). - New upstream release 1.11.2: * fix a regression caused by 1.11.1 where the process crashes if there are no CPU limits configured on cgroup v1. (boo#1217590) * fix error code check for the ptsname_r function. - update to 1.11.1: * force a remount operation with bind mounts from the host to correctly set all the mount flags. * cgroup: honor cpu burst. * systemd: set CPUQuota and CPUPeriod on the scope cgroup. * linux: append tmpfs mode if missing for mounts. This is the same behavior of runc. * cgroup: always use the user session for rootless. * support for Intel Resource Director Technology (RDT). * new mount option 'copy-symlink'. When provided for a mount, if the source is a symlink, then it is copied in the container instead of attempting a mount. * linux: open mounts before setgroups if in a userns. This solves a problem where a directory that was previously accessible to the user, become inaccessible after setgroups causing the bind mount to fail. - New upstream release 1.9.2: * cgroup: reset the inherited cpu affinity after moving to cgroup. Old kernels do that automatically, but new kernels remember the affinity that was set before the cgroup move, so we need to reset it in order to honor the cpuset configuration. - New upstream release 1.9.1: * utils: ignore ENOTSUP when chmod a symlink. It fixes a problem on Linux 6.6 that always refuses chmod on a symlink. * build: fix build on CentOS 7 * linux: add new fallback when mount fails with EBUSY, so that there is not an additional tmpfs mount if not needed. * utils: improve error message when a directory cannot be created as a component of the path is already existing as a non directory. - Only build with wasmedge on x86_64 & aarch64 - Add crun-wasm symlink for platform 'wasi/wasm' - Update to 1.9: * linux: support arbitrary idmapped mounts. * linux: add support for 'ridmap' mount option to support recursive idmapped mounts. * crun delete: call systemd's reset-failed. * linux: fix check for oom_score_adj. * features: Support mountExtensions. * linux: correctly handle unknown signal string when it doesn't start with a digit. * linux: do not attempt to join again already joined namespace. * wasmer: use latest wasix API. - Enable WasmEdge support to run Wasm compat containers. * linux: idmapped mounts expect the same configuration as mapping. It is a breaking change, but the behavior was aligned * cgroup: always delete the cgroup on errors. ° exec: fix double free when using --apparmor and The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2025-74 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MFFSKUX256PEK52RLQGT33MIN3ZQO27D/ E-Mail link for openSUSE-SU-2025:0074-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1217590 SUSE Bug 1217590 https://bugzilla.suse.com/1218894 SUSE Bug 1218894 https://bugzilla.suse.com/1237421 SUSE Bug 1237421 https://www.suse.com/security/cve/CVE-2024-21626/ SUSE CVE CVE-2024-21626 page https://www.suse.com/security/cve/CVE-2025-24965/ SUSE CVE CVE-2025-24965 page SUSE Package Hub 15 SP6 openSUSE Leap 15.6 crun-1.20-bp156.2.3.1 crun-1.20-bp156.2.3.1 as a component of SUSE Package Hub 15 SP6 crun-1.20-bp156.2.3.1 as a component of openSUSE Leap 15.6 runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue. CVE-2024-21626 SUSE Package Hub 15 SP6:crun-1.20-bp156.2.3.1 openSUSE Leap 15.6:crun-1.20-bp156.2.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MFFSKUX256PEK52RLQGT33MIN3ZQO27D/ https://www.suse.com/security/cve/CVE-2024-21626.html CVE-2024-21626 https://bugzilla.suse.com/1218894 SUSE Bug 1218894 crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current user to write to the target file. The problem is fixed in crun 1.20 and all users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2025-24965 SUSE Package Hub 15 SP6:crun-1.20-bp156.2.3.1 openSUSE Leap 15.6:crun-1.20-bp156.2.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MFFSKUX256PEK52RLQGT33MIN3ZQO27D/ https://www.suse.com/security/cve/CVE-2025-24965.html CVE-2025-24965 https://bugzilla.suse.com/1237421 SUSE Bug 1237421