October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1231786] New: VUL-0: CVE-2024-9676: cri-o: containers/storage: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)
by bugzilla_noreply＠suse.com 18 Oct '24

18 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231786 Bug ID: 1231786 Summary: VUL-0: CVE-2024-9676: cri-o: containers/storage: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) Classification: openSUSE Product: openSUSE Distribution Version: Leap 16.0 Hardware: Other URL: https://smash.suse.de/issue/424087/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: andrea.mattiazzo(a)suse.com QA Contact: qa-bugs(a)suse.de CC: andrea.mattiazzo(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Depends on: 1231698, 1231785 Target Milestone: --- Found By: Security Response Team Blocker: --- A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-9676 https://www.cve.org/CVERecord?id=CVE-2024-9676 https://access.redhat.com/security/cve/CVE-2024-9676 https://bugzilla.redhat.com/show_bug.cgi?id=2317467 https://github.com/advisories/GHSA-wq2p-5pc6-wpgf -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1231511] [Build 20241008-SELinux] openQA test fails in yast2_snapper_ncurses: Failed to create new snapshot
by bugzilla_noreply＠suse.com 18 Oct '24

18 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231511 https://bugzilla.suse.com/show_bug.cgi?id=1231511#c2 --- Comment #2 from Cathy Hu <cathy.hu(a)suse.com> --- this bug is only for this avc, see bsc#1231489 for the systemctl one: type=AVC msg=audit(1728549167.387:460): avc: denied { create } for pid=13984 comm="snapperd" name="1" scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir permissive=0 we only allow certain snapshots to be labeled snapperd_data_t, so if the test will use /test, the files are not labeled correctly -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231773] dracut cannot create initrd & initramfs on initrd-6.11.2-1-default
by bugzilla_noreply＠suse.com 18 Oct '24

18 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231773 https://bugzilla.suse.com/show_bug.cgi?id=1231773#c15 --- Comment #15 from Antonio Feijoo <antonio.feijoo(a)suse.com> --- Is /etc read-only on your system? > [ 10.332015] localhost CoolerControlD-x86_64.AppImage[2268]: Error: Saving configuration file: "/etc/coolercontrol/config.toml" > [ 10.332015] localhost CoolerControlD-x86_64.AppImage[2268]: Caused by: > [ 10.332103] localhost CoolerControlD-x86_64.AppImage[2268]: Read-only file system (os error 30) > ... > [ 11.943753] localhost.localdomain update_postmaps[2586]: chmod: changing permissions of '/etc/postfix/virtual.lmdb': Read-only file system > [ 11.945991] localhost.localdomain update_postmaps[2587]: chmod: changing permissions of '/etc/postfix/transport.lmdb': Read-only file system > [ 11.947840] localhost.localdomain update_postmaps[2588]: chmod: changing permissions of '/etc/postfix/access.lmdb': Read-only file system > [ 11.949348] localhost.localdomain update_postmaps[2589]: chmod: changing permissions of '/etc/postfix/canonical.lmdb': Read-only file system > [ 11.950814] localhost.localdomain update_postmaps[2590]: chmod: changing permissions of '/etc/postfix/sender_canonical.lmdb': Read-only file system > [ 11.952236] localhost.localdomain update_postmaps[2591]: chmod: changing permissions of '/etc/postfix/relocated.lmdb': Read-only file system > [ 11.953594] localhost.localdomain update_postmaps[2592]: chmod: changing permissions of '/etc/postfix/sasl_passwd.lmdb': Read-only file system > [ 11.955530] localhost.localdomain update_postmaps[2593]: chmod: changing permissions of '/etc/postfix/relay_ccerts.lmdb': Read-only file system > [ 11.957107] localhost.localdomain update_postmaps[2594]: chmod: changing permissions of '/etc/postfix/helo_access.lmdb': Read-only file system > [ 11.958604] localhost.localdomain update_postmaps[2595]: chmod: changing permissions of '/etc/postfix/relay.lmdb': Read-only file system > [ 11.960056] localhost.localdomain update_postmaps[2596]: chmod: changing permissions of '/etc/postfix/relay_recipients.lmdb': Read-only file system > ... > [ 14.294530] localhost.localdomain NetworkManager[2443]: <warn> [1729260610.8719] dns-mgr: could not commit DNS changes: Failed to create file “/etc/resolv.conf.6W6BW2”: Read-only file system -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231773] dracut cannot create initrd & initramfs on initrd-6.11.2-1-default
by bugzilla_noreply＠suse.com 18 Oct '24

18 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231773 https://bugzilla.suse.com/show_bug.cgi?id=1231773#c12 --- Comment #12 from Antonio Feijoo <antonio.feijoo(a)suse.com> --- Yes, there is no need to zypper dup to see the actual errors... although I have no idea what is happening. Could you attach the output of `journalctl -b -o short-monotonic` to check if there is any clue on the journal? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231773] dracut cannot create initrd & initramfs on initrd-6.11.2-1-default
by bugzilla_noreply＠suse.com 18 Oct '24

18 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231773 https://bugzilla.suse.com/show_bug.cgi?id=1231773#c10 --- Comment #10 from Antonio Feijoo <antonio.feijoo(a)suse.com> --- Let's perform a quick test, could you attach the output of: `sudo dracut -f --tmpdir /tmp test.img` -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1230280] Bcachefs: readdir() is broken in 32bit compat mode
by bugzilla_noreply＠suse.com 18 Oct '24

18 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1230280 https://bugzilla.suse.com/show_bug.cgi?id=1230280#c2 --- Comment #2 from Martin Doucha <martin.doucha(a)suse.com> --- (In reply to Martin Doucha from comment #0) > I've tried running the readdir01 test on bcachefs as well but somehow one of > the readdir() calls in it returns EOVERFLOW error. The test doesn't support > looping over all filesystems yet so run it as follows: > TMPDIR=/path/to/bcachefs/mountdir readdir01 The readdir tests have been updated and now run on all available filesystems automatically. The TMPDIR workaround above is not needed anymore, simply run the executable as is. Here are the latest Tumbleweed results (kernel v6.11.3): https://openqa.opensuse.org/tests/4574150#step/readdir01/8 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227144] iwlwifi 0000:6f:00.0: Microcode SW error detected. Restarting 0x0.
by bugzilla_noreply＠suse.com 18 Oct '24

18 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227144 https://bugzilla.suse.com/show_bug.cgi?id=1227144#c15 --- Comment #15 from Takashi Iwai <tiwai(a)suse.com> --- Then retest with the latest upstream kernel in OBS Kernel:stable:Backport repo again and see whether the issue appears with it or not. Honestly speaking, there is little thing we can do from the distro side for such a bug unless it's addressed in the upstream; it's a device-specific, mostly a firmware-related bug. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231773] dracut cannot create initrd & initramfs on initrd-6.11.2-1-default
by bugzilla_noreply＠suse.com 18 Oct '24

18 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231773 https://bugzilla.suse.com/show_bug.cgi?id=1231773#c6 --- Comment #6 from Antonio Feijoo <antonio.feijoo(a)suse.com> --- (In reply to 40476 WebDev from comment #5) > I have attached the file for before the update, currently working on running > the update. Thanks, although dracut returns 0 and the initrd is created, the build process already shows some signs that something is wrong on your system... > dracut-install: Handle '/usr/lib/systemd/system/initrd.target' > dracut-install: dracut_install('/usr/lib/systemd/system/initrd.target', '/usr/lib/systemd/system/initrd.target', 0, 0, 1) > dracut-install: dracut_install ret = 0 > dracut-install: cp '/usr/lib/systemd/system/initrd.target' '/var/tmp/dracut.Xy7dNc/initramfs/usr/lib/systemd/system/initrd.target' > dracut-install: cp ret = 0 > ... > /usr/lib/dracut/modules.d/01systemd-initrd/module-setup.sh@33(install): systemctl -q --root /var/tmp/dracut.Xy7dNc/initramfs set-default initrd.target > Failed to set default unit: Unit initrd.target does not exist > ... > dracut-install: cp '/usr/bin/bash' '/var/tmp/dracut.Xy7dNc/initramfs/usr/bin/bash' > dracut-install: cp ret = 0 > dracut-install: dracut_install ret = 0 > dracut-install: dracut_install '/usr/bin/bash' OK > /usr/lib/dracut/dracut-init.sh@313(inst_multiple): return 0 > /usr/lib/dracut/modules.d/99base/module-setup.sh@29(install): ln -s bash /var/tmp/dracut.Xy7dNc/initramfs/bin/sh > ln: failed to create symbolic link '/var/tmp/dracut.Xy7dNc/initramfs/bin/sh': File exists How is /var/tmp mounted on your system? Could you show the output of `cat /proc/mounts`? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227144] iwlwifi 0000:6f:00.0: Microcode SW error detected. Restarting 0x0.
by bugzilla_noreply＠suse.com 18 Oct '24

18 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227144 https://bugzilla.suse.com/show_bug.cgi?id=1227144#c14 --- Comment #14 from Andreas <opendreas(a)gmail.com> --- Created attachment 878078 --> https://bugzilla.suse.com/attachment.cgi?id=878078&action=edit dmesg-6.4.0-150600.23.25-2 the errors started appearing again. Here is the log when the laptop came out of standby and, while watching YouTube, wifi began to reconnect. Now the laptop is frozen, I turned it off and on, after starting Firefox (Flatpak) from Youtube, the wifi starts to reconnect again. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231720] [SELinux] policy can not be loaded in tumbleweed sdboot image
by bugzilla_noreply＠suse.com 18 Oct '24

18 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231720 https://bugzilla.suse.com/show_bug.cgi?id=1231720#c5 Cathy Hu <cathy.hu(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #5 from Cathy Hu <cathy.hu(a)suse.com> --- closing, done -- You are receiving this mail because: You are on the CC list for the bug.

1 0