Announcing new releases Alpha 3794.0.0, Beta 3760.1.0 and Stable 3602.2.2

11 views
Skip to first unread message

Flatcar Container Linux User

unread,
Nov 22, 2023, 6:00:29 AM11/22/23
to Flatcar Container Linux User

Hello,
We are pleased to announce a new Flatcar Container Linux release for the Alpha, Beta and Stable channels.

New Alpha Release 3794.0.0

This release removes the legacy “torcx” image customisation and replaces this feature with systemd-sysext. Torcx enabled users to deploy custom docker versions; however, it required special packaging using the Flatcar SDK. Please refer to the “Changes” section below for details.

This release ships a major Docker update: Docker was upgraded to version 24 (from version 20 in the previous release). Please see the “Changes” section below for details.

Changes since Alpha 3760.0.0

Security fixes:Bug fixes:
  • Fixed iterating over the OEM update payload signatures which prevented the AWS OEM update to 3745.x.y (update-engine#31)
  • Made sshkeys.service more robust to only run coreos-meta...@core.service when not masked and also retry on failure (init#112)
  • Set TTY used for fetching server_context to RAW mode before running cloudinit on cloudsigma (scripts#1280)
Known issues:
  • docker and containerd packages information are missing from flatcar_production_image_packages.txt (flatcar#1260)
Changes:
  • Torcx, the mechanism to provide a custom Docker version, was replaced by systemd-sysext in the OS image. Learn more about sysext and how to customise OS images here.
    • Torcx entered deprecation 2 years ago in favour of deploying plain Docker binaries
      (which is now also a legacy option because systemd-sysext offers a more robust and better structured way of customisation, including OS independent updates).
    • Torcx has been removed entirely; if you use Torcx to extend the Flatcar base OS image, please refer to our conversion script and to the sysext documentation mentioned above for migrating.
    • Consequently, update_engine will not perform torcx sanity checks post-update anymore.
    • Relevant changes: scripts#1216, update_engine#30, Mantle#466, Mantle#465.
  • cri-tools, runc, containerd, docker, and docker-cli are now built from Gentoo upstream ebuilds. Docker received a major version upgrade - it was updated to Docker 24 (from Docker 20; see “updates”).
    • NOTE: The docker btrfs storage driver has been de-prioritised; BTRFS backed storage will now default to the overlay2 driver
      (changelog, upstream pr).
      Using the btrfs driver can still be enforced by creating a respective docker config at /etc/docker/daemon.json.
    • NOTE: If you are already using btrfs-backed Docker storage and are upgrading to this new version, Docker will automatically use the btrfs storage driver for backwards-compatibility with your deployment.
      • Docker will remove the btrfs driver entirely in a future version. Please consider migrating your deployments to the overlay2 driver.
  • Brightbox: The regular OpenStack image should now be used, it includes Afterburn for instance metadata attributes
  • OpenStack: An uncompressed image is provided for simpler import (since the images use qcow2 inline compression, there is no benefit in using the .gz or .bz2 images)
Updates:New Beta Release 3760.1.0

:warning: From Alpha 3794.0.0 Torcx has been removed - please assert that you don’t rely on specific Torcx mechanism but now use systemd-sysext. See here for more information.

Changes since Beta 3745.1.0

Security fixes:Bug fixes:
  • Added AWS EKS support for versions 1.24-1.28. Fixed /usr/share/amazon/eks/download-kubelet.sh to include download paths for these versions. (scripts#1210)
  • Fixed iterating over the OEM update payload signatures which prevented the AWS OEM update to 3745.x.y (update-engine#31)
  • Fixed quotes handling for update-engine (Flatcar#1209)
  • Made sshkeys.service more robust to only run coreos-meta...@core.service when not masked and also retry on failure (init#112)
Changes:
  • Brightbox: The regular OpenStack image should now be used, it includes Afterburn for instance metadata attributes
  • OpenStack: An uncompressed image is provided for simpler import (since the images use qcow2 inline compression, there is no benefit in using the .gz or .bz2 images)
Updates:

Changes since Alpha 3760.0.0

Security fixes:Bug fixes:
  • Fixed iterating over the OEM update payload signatures which prevented the AWS OEM update to 3745.x.y (update-engine#31)
  • Made sshkeys.service more robust to only run coreos-meta...@core.service when not masked and also retry on failure (init#112)
Changes:
  • Brightbox: The regular OpenStack image should now be used, it includes Afterburn for instance metadata attributes
  • OpenStack: An uncompressed image is provided for simpler import (since the images use qcow2 inline compression, there is no benefit in using the .gz or .bz2 images)
Updates:New Stable Release 3602.2.2

:warning: From Alpha 3794.0.0 Torcx has been removed - please assert that you don’t rely on specific Torcx mechanism but now use systemd-sysext. See here for more information.

Changes since Stable 3602.2.1

Security fixes:Changes:
  • Brightbox: The regular OpenStack image should now be used, it includes Afterburn for instance metadata attributes
  • OpenStack: An uncompressed image is provided for simpler import (since the images use qcow2 inline compression, there is no benefit in using the .gz or .bz2 images)
  • linux kernel: added zstd support for squashfs kernel module (scripts#1297)
Updates:

Detailed Security Report

Security fix: With the Alpha 3794.0.0, Beta 3760.1.0 and Stable 3602.2.2 releases we ship fixes for the CVEs listed below.

Alpha 3794.0.0

  • Linux

    • CVE-2023-35827 CVSSv3 score: 7(High)
      An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.
    • CVE-2023-46813 CVSSv3 score: 7(High)
      An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.
    • CVE-2023-46862 CVSSv3 score: 4.7(Medium)
      An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.
    • CVE-2023-5178 CVSSv3 score: n/a
      A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges.
    • CVE-2023-5717 CVSSv3 score: n/a
      A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

  • VMWare: open-vm-tools

  • nghttp2

    • CVE-2023-44487 CVSSv3 score: 7.5(High)
      The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  • samba

    • CVE-2023-4091 CVSSv3 score: n/a
      A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.

  • zlib

    • CVE-2023-45853 CVSSv3 score: 9.8(Critical)
      MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product.
Beta 3760.1.0

  • Linux

    • CVE-2023-35827 CVSSv3 score: 7(High)
      An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.
    • CVE-2023-46813 CVSSv3 score: 7(High)
      An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.
    • CVE-2023-46862 CVSSv3 score: 4.7(Medium)
      An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.
    • CVE-2023-5178 CVSSv3 score: n/a
      A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges.
    • CVE-2023-5717 CVSSv3 score: n/a
      A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

  • curl

    • CVE-2023-38545 CVSSv3 score: 9.8(Critical)
      This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.

      When curl is asked to pass along the host name to the SOCKS5 proxy to allow
      that to resolve the address instead of it getting done by curl itself, the
      maximum length that host name can be is 255 bytes.

      If the host name is detected to be longer, curl switches to local name
      resolving and instead passes on the resolved address only. Due to this bug,
      the local variable that means "let the host resolve the name" could get the
      wrong value during a slow SOCKS5 handshake, and contrary to the intention,
      copy the too long host name to the target buffer instead of copying just the
      resolved address there.

      The target buffer being a heap based buffer, and the host name coming from the
      URL that curl has been told to operate with.

    • CVE-2023-38546 CVSSv3 score: 3.7(Low)
      This flaw allows an attacker to insert cookies at will into a running program
      using libcurl, if the specific series of conditions are met.

      libcurl performs transfers. In its API, an application creates "easy handles"
      that are the individual handles for single transfers.

      libcurl provides a function call that duplicates en easy handle called
      curl_easy_duphandle.

      If a transfer has cookies enabled when the handle is duplicated, the
      cookie-enable state is also cloned - but without cloning the actual
      cookies. If the source handle did not read any cookies from a specific file on
      disk, the cloned version of the handle would instead store the file name as
      none (using the four ASCII letters, no quotes).

      Subsequent use of the cloned handle that does not explicitly set a source to
      load cookies from would then inadvertently load cookies from a file named
      none - if such a file exists and is readable in the current directory of the
      program using libcurl. And if using the correct file format of course.

  • glibc

    • CVE-2023-4911 CVSSv3 score: n/a
      A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

  • go

    • CVE-2023-39325 CVSSv3 score: 7.5(High)
      A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.
    • CVE-2023-39325 CVSSv3 score: 7.5(High)
      A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

  • grub

    • CVE-2023-4692 CVSSv3 score: 7.8(High)
      An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.
    • CVE-2023-4693 CVSSv3 score: 4.6(Medium)
      An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk.
Stable 3602.2.2
  • Linux

    • CVE-2023-46813 CVSSv3 score: 7(High)
      An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.

    • CVE-2023-5178 CVSSv3 score: n/a
      A use-after-free vulnerability was found in drivers/nvme/target/tcp.cinnvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation in case that the attacker already has local privileges.

    • CVE-2023-5717 CVSSv3 score: n/a
      A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation.

      If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer.

      We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

Best,
The Flatcar Container Linux Maintainers

Reply all
Reply to author
Forward
This conversation is locked
You cannot reply and perform actions on locked conversations.
0 new messages