SUSE-SU-2023:4936-1: Security update for docker, rootlesskit
This update for docker, rootlesskit fixes the following issues: docker: Update to Docker 24.0.7-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513
Deny containers access to /sys/devices/virtual/powercap by default.
CVE-2020-8694 bsc#1170415 CVE-2020-8695 bsc#1170446 CVE-2020-12912 bsc#1178760
Update to Docker 24.0.6-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2406 . bsc#1215323
Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141
Update to Docker 24.0.5-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2405 . bsc#1213229 This update ships docker-rootless support in the docker-rootless-extra package. (jsc#PED-6180) rootlesskit: new package, for docker rootless support. (jsc#PED-6180)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/dockerto a version that resolves this vulnerability.Fixed in 24.0.7_ce-150000.190.4 - Upgrade
Upgrade
suse/docker-debuginfoto a version that resolves this vulnerability.Fixed in 24.0.7_ce-150000.190.4 - Upgrade
Upgrade
suse/rootlesskitto a version that resolves this vulnerability.Fixed in 1.1.1-150000.1.3.3 - Upgrade
Upgrade
suse/rootlesskit-debuginfoto a version that resolves this vulnerability.Fixed in 1.1.1-150000.1.3.3 - Upgrade
Upgrade
suse/docker-bash-completionto a version that resolves this vulnerability.Fixed in 24.0.7_ce-150000.190.4 - Upgrade
Upgrade
suse/docker-fish-completionto a version that resolves this vulnerability.Fixed in 24.0.7_ce-150000.190.4 - Upgrade
Upgrade
suse/docker-rootless-extrasto a version that resolves this vulnerability.Fixed in 24.0.7_ce-150000.190.4 - Upgrade
Upgrade
suse/docker-zsh-completionto a version that resolves this vulnerability.Fixed in 24.0.7_ce-150000.190.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.3-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.4-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.5-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Containers-15-SP4-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Containers-15-SP5-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SUSE-MicroOS-5.1-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SUSE-MicroOS-5.2-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.3-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.4-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.4-2023-4936=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2023-4936=1 - Configuration
Add the docker.socket unit file with socket activation effectively disabled so Docker continues to run even when the socket is started.
Docker socket activation = disabled
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Docker deployments are specifically addressed by the container access restriction?
The update changes Docker's default behavior to deny containers access to /sys/devices/virtual/powercap. Deployments that expose this path to containers are the most directly relevant.
Does this update add support for running Docker without root privileges?
Yes. Docker rootless support is shipped in the docker-rootless-extra package, and rootlesskit is introduced as a package supporting Docker rootless operation.
Should administrators enable the newly added docker.socket unit?
No. The advisory states that socket activation is effectively disabled so Docker continues to run even if the socket is started independently, and users should probably ignore the unit file.