search

docker-library / php

Docker Official Image packaging for PHP
https://php.net
MIT License
3.79k stars 2k forks source link

Linux kernel vulenrability #1379

Closed vijaymandloi closed 1 year ago

vijaymandloi commented 1 year ago

Hi We are seeing a number of Linux kernel vulnerabilities in our images after the ECR scan. We tried to update the images but the Linux kernel vulnerabilities persist. What will be the impact of these on our applications? I am attaching the screenshot of these vulnerabilities.

snap_vulenrability

wglambert commented 1 year ago

Container's use the host's kernel https://ervinszilagyi.dev/articles/containers-under-the-hood.html#process-isolation

See also https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves And https://github.com/docker-library/openjdk/issues/449#issuecomment-763027011, https://github.com/docker-library/postgres/issues/286#issuecomment-302512767 docker-library/openjdk#161, docker-library/openjdk#112, docker-library/postgres#286, docker-library/drupal#84, docker-library/official-images#2740, docker-library/ruby#117, docker-library/ruby#94, docker-library/python#152, docker-library/php#242, docker-library/buildpack-deps#46, docker-library/openjdk#185.

A CVE doesn't imply having an actual vulnerability, and often is even a false positive (given how most distributions handle versioning/security updates in stable releases). If there are actionable items we can resolve, we're happy to do so (and do so actively). We update all Debian based images to include any updates in apt packages at least monthly (we regenerate the base images and then rebuild all dependent images).

yosifkit commented 1 year ago

Yup, container's use the host's kernel and images don't usually even have any kernel packages installed, so any scanner reporting CVE's on a kernel package is a false positive (and reflective of the scanning environment, not the image).

Closing since the PHP images do not have kernel packages installed.

$ docker run -it --rm php bash
root@f700f606c5be:/# apt list | grep linux-image

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

root@f700f606c5be:/# apt list
Listing... Done
adduser/now 3.118 all [installed,local]
apt/now 2.2.4 amd64 [installed,local]
autoconf/now 2.69-14 all [installed,local]
base-files/now 11.1+deb11u6 amd64 [installed,local]
base-passwd/now 3.5.51 amd64 [installed,local]
bash/now 5.1-2+deb11u1 amd64 [installed,local]
binutils-common/now 2.35.2-2 amd64 [installed,local]
binutils-x86-64-linux-gnu/now 2.35.2-2 amd64 [installed,local]
binutils/now 2.35.2-2 amd64 [installed,local]
bsdutils/now 1:2.36.1-8+deb11u1 amd64 [installed,local]
bzip2/now 1.0.8-4 amd64 [installed,local]
ca-certificates/now 20210119 all [installed,local]
coreutils/now 8.32-4+b1 amd64 [installed,local]
cpp-10/now 10.2.1-6 amd64 [installed,local]
cpp/now 4:10.2.1-1 amd64 [installed,local]
curl/now 7.74.0-1.3+deb11u5 amd64 [installed,local]
dash/now 0.5.11+git20200708+dd9ef66-5 amd64 [installed,local]
debconf/now 1.5.77 all [installed,local]
debian-archive-keyring/now 2021.1.1 all [installed,local]
debianutils/now 4.11.2 amd64 [installed,local]
diffutils/now 1:3.7-5 amd64 [installed,local]
dpkg-dev/now 1.20.12 all [installed,local]
dpkg/now 1.20.12 amd64 [installed,local]
e2fsprogs/now 1.46.2-2 amd64 [installed,local]
file/now 1:5.39-3 amd64 [installed,local]
findutils/now 4.8.0-1 amd64 [installed,local]
g++-10/now 10.2.1-6 amd64 [installed,local]
g++/now 4:10.2.1-1 amd64 [installed,local]
gcc-10-base/now 10.2.1-6 amd64 [installed,local]
gcc-10/now 10.2.1-6 amd64 [installed,local]
gcc-9-base/now 9.3.0-22 amd64 [installed,local]
gcc/now 4:10.2.1-1 amd64 [installed,local]
gpgv/now 2.2.27-2+deb11u2 amd64 [installed,local]
grep/now 3.6-1 amd64 [installed,local]
gzip/now 1.10-4+deb11u1 amd64 [installed,local]
hostname/now 3.23 amd64 [installed,local]
init-system-helpers/now 1.60 all [installed,local]
libacl1/now 2.2.53-10 amd64 [installed,local]
libapt-pkg6.0/now 2.2.4 amd64 [installed,local]
libargon2-1/now 0~20171227-0.2 amd64 [installed,local]
libasan6/now 10.2.1-6 amd64 [installed,local]
libatomic1/now 10.2.1-6 amd64 [installed,local]
libattr1/now 1:2.4.48-6 amd64 [installed,local]
libaudit-common/now 1:3.0-2 all [installed,local]
libaudit1/now 1:3.0-2 amd64 [installed,local]
libbinutils/now 2.35.2-2 amd64 [installed,local]
libblkid1/now 2.36.1-8+deb11u1 amd64 [installed,local]
libbrotli1/now 1.0.9-2+b2 amd64 [installed,local]
libbz2-1.0/now 1.0.8-4 amd64 [installed,local]
libc-bin/now 2.31-13+deb11u5 amd64 [installed,local]
libc-dev-bin/now 2.31-13+deb11u5 amd64 [installed,local]
libc6-dev/now 2.31-13+deb11u5 amd64 [installed,local]
libc6/now 2.31-13+deb11u5 amd64 [installed,local]
libcap-ng0/now 0.7.9-2.2+b1 amd64 [installed,local]
libcc1-0/now 10.2.1-6 amd64 [installed,local]
libcom-err2/now 1.46.2-2 amd64 [installed,local]
libcrypt-dev/now 1:4.4.18-4 amd64 [installed,local]
libcrypt1/now 1:4.4.18-4 amd64 [installed,local]
libctf-nobfd0/now 2.35.2-2 amd64 [installed,local]
libctf0/now 2.35.2-2 amd64 [installed,local]
libcurl4/now 7.74.0-1.3+deb11u5 amd64 [installed,local]
libdb5.3/now 5.3.28+dfsg1-0.8 amd64 [installed,local]
libdebconfclient0/now 0.260 amd64 [installed,local]
libdpkg-perl/now 1.20.12 all [installed,local]
libext2fs2/now 1.46.2-2 amd64 [installed,local]
libffi7/now 3.3-6 amd64 [installed,local]
libgcc-10-dev/now 10.2.1-6 amd64 [installed,local]
libgcc-s1/now 10.2.1-6 amd64 [installed,local]
libgcrypt20/now 1.8.7-6 amd64 [installed,local]
libgdbm-compat4/now 1.19-2 amd64 [installed,local]
libgdbm6/now 1.19-2 amd64 [installed,local]
libglib2.0-0/now 2.66.8-1 amd64 [installed,local]
libgmp10/now 2:6.2.1+dfsg-1+deb11u1 amd64 [installed,local]
libgnutls30/now 3.7.1-5+deb11u2 amd64 [installed,local]
libgomp1/now 10.2.1-6 amd64 [installed,local]
libgpg-error0/now 1.38-2 amd64 [installed,local]
libgssapi-krb5-2/now 1.18.3-6+deb11u3 amd64 [installed,local]
libhogweed6/now 3.7.3-1 amd64 [installed,local]
libicu67/now 67.1-7 amd64 [installed,local]
libidn2-0/now 2.3.0-5 amd64 [installed,local]
libisl23/now 0.23-1 amd64 [installed,local]
libitm1/now 10.2.1-6 amd64 [installed,local]
libk5crypto3/now 1.18.3-6+deb11u3 amd64 [installed,local]
libkeyutils1/now 1.6.1-2 amd64 [installed,local]
libkrb5-3/now 1.18.3-6+deb11u3 amd64 [installed,local]
libkrb5support0/now 1.18.3-6+deb11u3 amd64 [installed,local]
libldap-2.4-2/now 2.4.57+dfsg-3+deb11u1 amd64 [installed,local]
liblsan0/now 10.2.1-6 amd64 [installed,local]
liblz4-1/now 1.9.3-2 amd64 [installed,local]
liblzma5/now 5.2.5-2.1~deb11u1 amd64 [installed,local]
libmagic-mgc/now 1:5.39-3 amd64 [installed,local]
libmagic1/now 1:5.39-3 amd64 [installed,local]
libmount1/now 2.36.1-8+deb11u1 amd64 [installed,local]
libmpc3/now 1.2.0-1 amd64 [installed,local]
libmpfr6/now 4.1.0-3 amd64 [installed,local]
libnettle8/now 3.7.3-1 amd64 [installed,local]
libnghttp2-14/now 1.43.0-1 amd64 [installed,local]
libnsl-dev/now 1.3.0-2 amd64 [installed,local]
libnsl2/now 1.3.0-2 amd64 [installed,local]
libonig5/now 6.9.6-1.1 amd64 [installed,local]
libp11-kit0/now 0.23.22-1 amd64 [installed,local]
libpam-modules-bin/now 1.4.0-9+deb11u1 amd64 [installed,local]
libpam-modules/now 1.4.0-9+deb11u1 amd64 [installed,local]
libpam-runtime/now 1.4.0-9+deb11u1 all [installed,local]
libpam0g/now 1.4.0-9+deb11u1 amd64 [installed,local]
libpcre2-8-0/now 10.36-2+deb11u1 amd64 [installed,local]
libpcre3/now 2:8.39-13 amd64 [installed,local]
libperl5.32/now 5.32.1-4+deb11u2 amd64 [installed,local]
libpsl5/now 0.21.0-1.2 amd64 [installed,local]
libquadmath0/now 10.2.1-6 amd64 [installed,local]
libreadline8/now 8.1-1 amd64 [installed,local]
librtmp1/now 2.4+20151223.gitfa8646d.1-2+b2 amd64 [installed,local]
libsasl2-2/now 2.1.27+dfsg-2.1+deb11u1 amd64 [installed,local]
libsasl2-modules-db/now 2.1.27+dfsg-2.1+deb11u1 amd64 [installed,local]
libseccomp2/now 2.5.1-1+deb11u1 amd64 [installed,local]
libselinux1/now 3.1-3 amd64 [installed,local]
libsemanage-common/now 3.1-1 all [installed,local]
libsemanage1/now 3.1-1+b2 amd64 [installed,local]
libsepol1/now 3.1-1 amd64 [installed,local]
libsigsegv2/now 2.13-1 amd64 [installed,local]
libsmartcols1/now 2.36.1-8+deb11u1 amd64 [installed,local]
libsodium23/now 1.0.18-1 amd64 [installed,local]
libsqlite3-0/now 3.34.1-3 amd64 [installed,local]
libss2/now 1.46.2-2 amd64 [installed,local]
libssh2-1/now 1.9.0-2 amd64 [installed,local]
libssl1.1/now 1.1.1n-0+deb11u4 amd64 [installed,local]
libstdc++-10-dev/now 10.2.1-6 amd64 [installed,local]
libstdc++6/now 10.2.1-6 amd64 [installed,local]
libsystemd0/now 247.3-7+deb11u1 amd64 [installed,local]
libtasn1-6/now 4.16.0-2+deb11u1 amd64 [installed,local]
libtinfo6/now 6.2+20201114-2 amd64 [installed,local]
libtirpc-common/now 1.3.1-1+deb11u1 all [installed,local]
libtirpc-dev/now 1.3.1-1+deb11u1 amd64 [installed,local]
libtirpc3/now 1.3.1-1+deb11u1 amd64 [installed,local]
libtsan0/now 10.2.1-6 amd64 [installed,local]
libubsan1/now 10.2.1-6 amd64 [installed,local]
libudev1/now 247.3-7+deb11u1 amd64 [installed,local]
libunistring2/now 0.9.10-4 amd64 [installed,local]
libuuid1/now 2.36.1-8+deb11u1 amd64 [installed,local]
libxml2/now 2.9.10+dfsg-6.7+deb11u3 amd64 [installed,local]
libxxhash0/now 0.8.0-2 amd64 [installed,local]
libzstd1/now 1.4.8+dfsg-2.1 amd64 [installed,local]
linux-libc-dev/now 5.10.162-1 amd64 [installed,local]
login/now 1:4.8.1-1 amd64 [installed,local]
logsave/now 1.46.2-2 amd64 [installed,local]
lsb-base/now 11.1.0 all [installed,local]
m4/now 1.4.18-5 amd64 [installed,local]
make/now 4.3-4.1 amd64 [installed,local]
mawk/now 1.3.4.20200120-2 amd64 [installed,local]
mount/now 2.36.1-8+deb11u1 amd64 [installed,local]
ncurses-base/now 6.2+20201114-2 all [installed,local]
ncurses-bin/now 6.2+20201114-2 amd64 [installed,local]
openssl/now 1.1.1n-0+deb11u4 amd64 [installed,local]
passwd/now 1:4.8.1-1 amd64 [installed,local]
patch/now 2.7.6-7 amd64 [installed,local]
perl-base/now 5.32.1-4+deb11u2 amd64 [installed,local]
perl-modules-5.32/now 5.32.1-4+deb11u2 all [installed,local]
perl/now 5.32.1-4+deb11u2 amd64 [installed,local]
pkg-config/now 0.29.2-1 amd64 [installed,local]
re2c/now 2.0.3-1 amd64 [installed,local]
readline-common/now 8.1-1 all [installed,local]
sed/now 4.7-1 amd64 [installed,local]
sysvinit-utils/now 2.96-7+deb11u1 amd64 [installed,local]
tar/now 1.34+dfsg-1 amd64 [installed,local]
tzdata/now 2021a-1+deb11u8 all [installed,local]
util-linux/now 2.36.1-8+deb11u1 amd64 [installed,local]
xz-utils/now 5.2.5-2.1~deb11u1 amd64 [installed,local]
zlib1g/now 1:1.2.11.dfsg-2+deb11u2 amd64 [installed,local]