SUSE update for containerd, docker, runc



Published: 2023-12-01
Risk Low
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2020-12912
CVE-2020-8694
CVE-2020-8695
CWE-ID CWE-200
CWE-284
CWE-204
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		Containers Module
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications 12
Operating systems & Components / Operating system

SUSE Linux Enterprise Server 12
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing 12
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications
Operating systems & Components / Operating system

SUSE Linux Enterprise Server
Operating systems & Components / Operating system

runc
Operating systems & Components / Operating system package or component

docker-debuginfo
Operating systems & Components / Operating system package or component

runc-debuginfo
Operating systems & Components / Operating system package or component

containerd
Operating systems & Components / Operating system package or component

docker
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU48373

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-12912

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Running Average Power Limit (RAPL) interface. A local user can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected package containerd, docker, runc to the latest version.

Vulnerable software versions

Containers Module: 12

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

runc: before 1.1.10-16.40.1

docker-debuginfo: before 24.0.7_ce-98.103.1

runc-debuginfo: before 1.1.10-16.40.1

containerd: before 1.7.8-16.88.1

docker: before 24.0.7_ce-98.103.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20234625-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU48371

Risk: Low

CVSSv3.1: 4.9 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-8694

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the Linux kernel driver. A local user can bypass implemented security restrictions and gain unauthorized access to sensitive information on the system.

Affected products:

Product Collection

Vertical Segment

CPUID

8th Generation Intel® Core™ Processor Family

Mobile

806E9

10th Generation Intel® Core™ Processor Family

Mobile

806EC

8th Generation Intel® Core™ Processor Family

Mobile

906EA

9th Generation Intel® Core™ Processor Family

Mobile

906EC

8th Generation Intel® Core™ Processor Family

Desktop

906EA

9th Generation Intel® Core™ Processor Family

Desktop

906EC

Intel® Xeon® Processor E Family

Server Workstation AMT Server

906EA

8th Generation Intel® Core™ Processor Family

Mobile

806EA

8th Generation Intel® Core™ Processor Family Intel® Pentium® Gold Processor Series Intel® Celeron® Processor G Series

Desktop

906EB

Intel® Xeon® Processor E Family

Server Workstation AMT Server

906EA

8th Generation Intel® Core™ Processor Family

Desktop

906EA

9th Generation Intel® Core™ Processor Family

Desktop

906ED

9th Generation Intel® Core™ Processor Family

Desktop

906ED

10th Generation Intel® Core™ Processor Family

Mobile

A0660

10th Generation Intel® Core™ Processor Family

Mobile

A0661

10th Generation Intel® Core™ Processor Family

Mobile

806EC

10th Generation Intel® Core™ Processor Family

Desktop

A0653

10th Generation Intel® Core™ Processor Family

Mobile

A0655

10th Generation Intel® Core™ Processor Family

Mobile

A0652

Intel® Pentium® Processor Silver Series Intel® Celeron® Processor J Series Intel® Celeron® Processor N Series

Desktop Mobile Embedded

706A1

Intel® Pentium® Processor Silver Series Intel® Celeron® Processor J Series Intel® Celeron® Processor N Series

Desktop Mobile Embedded

706A8

10th Generation Intel® Core™ Processor Family

Mobile

706E5

8th Generation Intel® Core™ Processor Family

Mobile

906E9

7th Generation Intel® Core™ Processor Family

Mobile Embedded

906E9

8th Generation Intel® Core™  Processor Family

Mobile

806EA

7th Generation Intel® Core™ Processor Family

Desktop Embedded

906E9

7th Generation Intel® Core™ Processor Family

Mobile

806E9

7th Generation Intel® Core™

Processor Family

Mobile

806E9

Intel® Core™ X-series Processors

Desktop

906E9

Intel® Xeon® Processor E3 v6 Family

Server Workstation AMT Server

906E9

7th Generation Intel® Core™ Processor Family

Mobile

806E9

6th Generation Intel® Core™ Processor Family

Mobile

506E3

6th Generation Intel® Core™ Processor Family

Desktop Embedded

506E3

6th Generation Intel® Core™ Processors

Mobile

406E3

6th Generation Intel® Core™ Processor Family

Mobile

406E3

Intel® Xeon® Processor E3 v5 Family

Server Workstation AMT Server

506E3

6th Generation Intel® Core™ Processor Family

Mobile

406E3

8th Generation Intel® Core™ Processors

Mobile

806EB

8th Generation Intel® Core™ Processors

Mobile

806EC

Mitigation

Update the affected package containerd, docker, runc to the latest version.

Vulnerable software versions

Containers Module: 12

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

runc: before 1.1.10-16.40.1

docker-debuginfo: before 24.0.7_ce-98.103.1

runc-debuginfo: before 1.1.10-16.40.1

containerd: before 1.7.8-16.88.1

docker: before 24.0.7_ce-98.103.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20234625-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Observable Response Discrepancy

EUVDB-ID: #VU48372

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-8695

CWE-ID: CWE-204 - Observable Response Discrepancy

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to observable discrepancy in the Running Average Power Limit (RAPL) Interface. A local administrator can gain access to sensitive information on the target system.

Affected products:

Product Collection

Vertical Segment

CPUID

8th Generation Intel® Core™ Processor Family

Mobile

806E9

10th Generation Intel® Core™ Processor Family

Mobile

806EC

8th Generation Intel® Core™ Processor Family

Mobile

906EA

9th Generation Intel® Core™ Processor Family

Mobile

906EC

8th Generation Intel® Core™ Processor Family

Desktop

906EA

9th Generation Intel® Core™ Processor Family

Desktop

906EC

Intel® Xeon® Processor E Family

Server Workstation AMT Server

906EA

8th Generation Intel® Core™ Processor Family

Mobile

806EA

8th Generation Intel® Core™ Processor Family Intel® Pentium® Gold Processor Series Intel® Celeron® Processor G Series

Desktop

906EB

Intel® Xeon® Processor E Family

Server Workstation AMT Server

906EA

8th Generation Intel® Core™ Processor Family

Desktop

906EA

9th Generation Intel® Core™ Processor Family

Desktop

906ED

9th Generation Intel® Core™ Processor Family

Desktop

906ED

10th Generation Intel® Core™ Processor Family

Mobile

A0660

10th Generation Intel® Core™ Processor Family

Mobile

A0661

10th Generation Intel® Core™ Processor Family

Mobile

806EC

10th Generation Intel® Core™ Processor Family

Desktop

A0653

10th Generation Intel® Core™ Processor Family

Mobile

A0655

10th Generation Intel® Core™ Processor Family

Mobile

A0652

Intel® Pentium® Processor Silver Series Intel® Celeron® Processor J Series Intel® Celeron® Processor N Series

Desktop Mobile Embedded

706A1

Intel® Pentium® Processor Silver Series Intel® Celeron® Processor J Series Intel® Celeron® Processor N Series

Desktop Mobile Embedded

706A8

10th Generation Intel® Core™ Processor Family

Mobile

706E5

8th Generation Intel® Core™ Processor Family

Mobile

906E9

7th Generation Intel® Core™ Processor Family

Mobile Embedded

906E9

8th Generation Intel® Core™  Processor Family

Mobile

806EA

7th Generation Intel® Core™ Processor Family

Desktop Embedded

906E9

7th Generation Intel® Core™ Processor Family

Mobile

806E9

7th Generation Intel® Core™

Processor Family

Mobile

806E9

Intel® Core™ X-series Processors

Desktop

906E9

Intel® Xeon® Processor E3 v6 Family

Server Workstation AMT Server

906E9

7th Generation Intel® Core™ Processor Family

Mobile

806E9

6th Generation Intel® Core™ Processor Family

Mobile

506E3

6th Generation Intel® Core™ Processor Family

Desktop Embedded

506E3

6th Generation Intel® Core™ Processors

Mobile

406E3

6th Generation Intel® Core™ Processor Family

Mobile

406E3

Intel® Xeon® Processor E3 v5 Family

Server Workstation AMT Server

506E3

6th Generation Intel® Core™ Processor Family

Mobile

406E3

8th Generation Intel® Core™ Processors

Mobile

806EB

8th Generation Intel® Core™ Processors

Mobile

806EC

Mitigation

Update the affected package containerd, docker, runc to the latest version.

Vulnerable software versions

Containers Module: 12

SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5

SUSE Linux Enterprise Server 12: SP1 - SP5

SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP4

SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON

runc: before 1.1.10-16.40.1

docker-debuginfo: before 24.0.7_ce-98.103.1

runc-debuginfo: before 1.1.10-16.40.1

containerd: before 1.7.8-16.88.1

docker: before 24.0.7_ce-98.103.1

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20234625-1/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###