fix(deps): update module github.com/containerd/containerd to v2 [security] (alauda-3.18.6)#90
Closed
alaudaa-renovate[bot] wants to merge 1 commit into
Conversation
alaudaa-renovate
Bot
force-pushed
the
renovate/alauda-3.18.6-go-github.com-containerd-containerd-vulnerability
branch
from
813908d to
da7b40b
Compare
|
Closing this stale Renovate PR. It attempts a major-version move to github.com/containerd/containerd/v2 v2.0.0 and fails build because the code still imports github.com/containerd/containerd/remotes. The security fix for alauda-3.18.6 has been applied via #91 by updating the 1.7.x line to github.com/containerd/containerd v1.7.32. |
alaudaa-renovate
Bot
deleted the
renovate/alauda-3.18.6-go-github.com-containerd-containerd-vulnerability
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.7.31->v2.0.0containerd user ID handling bypass allows runAsNonRoot evasion
CVE-2026-46680 / GHSA-fqw6-gf59-qr4w
More information
Details
Impact
A bug was found in containerd where containers launched with a numeric
Userdirective that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an/etc/passwdfile mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the KubernetesrunAsNonRootrestriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user.Patches
This bug has been fixed in the following containerd versions:
Note: The containerd 2.1 release has reached its end of life and a fixed version is not provided.
Users should update to these versions to resolve the issue.
Workarounds
Ensure that only trusted images are used and that only trusted users have permissions to import images. Alternatively, enforcing a specific numeric
runAsUserin the Kubernetes PodsecurityContextoverrides theUSERdirective in the image and prevents the bypass. Newer versions of Kubernetes, starting with 1.34, also appear to enforcerunAsNonRootproperly regardless of this bug.Credits
The containerd project would like to thank Lei Wang (@ssst0n3) for responsibly disclosing this issue in accordance with the containerd security policy.
Resources
For more information
If there are any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
containerd/containerd (github.com/containerd/containerd)
v2.0.0: containerd 2.0.0Compare Source
Welcome to the v2.0.0 release of containerd!
The first major release of containerd 2.x focuses on the continued stability of
containerd's core feature set with an easy upgrade from containerd 1.x. This
release includes the stabilization of new features added in the last 1.x release
as well as the removal of features which were deprecated in 1.x. The goal is to
support the vast community of containerd users well into the future along with
their ever increasing deployment footprints and variety of use cases.
See containerd 2.0 documentation for details on what is new and has changed in this release.
Highlights
LimitNOFILEfromcontainerd.service(#8924)aufssnapshotter (#8263)Build and Release Toolchain
cri-containerd-*.tar.gzrelease bundles (#9096)Container Runtime Interface (CRI)
Go client
Image Distribution
Runtime
io.containerd.runtime.v1.linuxandio.containerd.runc.v1(#8262)Security Advisories
Breaking
disable_cgroupfrom CRI config (#10594)LimitNOFILEfromcontainerd.service(#8924)io.containerd.runtime.v1.linuxandio.containerd.runc.v1(#8262)aufssnapshotter (#8263)Deprecations
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Dependency Changes
1f10f66->e8a1dd75330a85->2b5cbb2ea5083fnewd8f796aa7dc8b6newcca7078new3a7f492-> v1.1.0946c877->2e043c65d4384e78d3cae->78284952eb08e3-> v0.0.4686a1a2new432b235-> v0.9.0aacd6d4new90d013b-> v0.3.05fefd90new324edc3newa5ecb01->18e509bf223a00->bc3834cPrevious release can be found at v1.7.0
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
Configuration
📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.