CVE-2020-14386

highpriority · track · 41EPSS 0.013 · 70 %ileexploit · PoCEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

1.31% (70th) EPSS

CVSS 7.2 · high

Is it mine?

70 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-26

A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedbpftool-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-0:4.18.0-193.28.1.el8_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-abi-whitelists-0:4.18.0-193.28.1.el8_2.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-core-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-core-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-core-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-core-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-core-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-core-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-core-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-core-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-devel-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-devel-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-devel-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-devel-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-modules-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-modules-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-modules-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-modules-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-modules-extra-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-modules-extra-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-modules-extra-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debug-modules-extra-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-common-aarch64-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-common-aarch64-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-common-s390x-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-common-x86_64-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-debuginfo-common-x86_64-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-devel-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-devel-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-devel-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-devel-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-doc-0:4.18.0-193.28.1.el8_2.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-modules-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-modules-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-modules-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-modules-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-modules-extra-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-modules-extra-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-modules-extra-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-modules-extra-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-libs-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-libs-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-libs-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-libs-devel-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-libs-devel-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-tools-libs-devel-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-zfcpdump-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-zfcpdump-core-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-zfcpdump-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-zfcpdump-devel-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-zfcpdump-modules-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedkernel-zfcpdump-modules-extra-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedperf-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4286
Fixedbpftool-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedbpftool-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedbpftool-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedbpftool-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-0:4.18.0-147.32.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-abi-whitelists-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-common-s390x-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-doc-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-libs-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-zfcpdump-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-zfcpdump-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-zfcpdump-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-zfcpdump-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-zfcpdump-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-zfcpdump-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4287
Fixedkernel-rt-0:4.18.0-193.28.1.rt13.77.el8_2.src as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-0:4.18.0-193.28.1.rt13.77.el8_2.src as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-core-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-core-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-core-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-core-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-debuginfo-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-debuginfo-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-devel-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-devel-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-kvm-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-modules-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-modules-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-modules-extra-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debug-modules-extra-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debuginfo-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debuginfo-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debuginfo-common-x86_64-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-debuginfo-common-x86_64-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-devel-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-devel-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-kvm-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-modules-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-modules-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-modules-extra-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedkernel-rt-modules-extra-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:4289
Fixedbpftool-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedbpftool-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedbpftool-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedbpftool-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-0:4.18.0-80.31.1.el8_0.src as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-abi-whitelists-0:4.18.0-80.31.1.el8_0.noarch as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-core-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-core-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-core-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-core-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-devel-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-devel-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-modules-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-modules-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-modules-extra-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debug-modules-extra-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debuginfo-common-ppc64le-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-debuginfo-common-x86_64-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-devel-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-devel-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-doc-0:4.18.0-80.31.1.el8_0.noarch as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-modules-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-modules-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-modules-extra-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-modules-extra-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-tools-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-tools-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-tools-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-tools-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-tools-libs-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedkernel-tools-libs-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedperf-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedperf-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedperf-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedperf-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedpython3-perf-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedpython3-perf-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedpython3-perf-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Fixedpython3-perf-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.
https://access.redhat.com/errata/RHSA-2020:5199
Workaroundbpftool-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-193.28.1.el8_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-abi-whitelists-0:4.18.0-193.28.1.el8_2.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-core-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-core-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-core-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-core-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-core-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-core-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-core-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-core-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-devel-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-devel-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-devel-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-devel-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-extra-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-extra-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-extra-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-extra-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-s390x-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-devel-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-devel-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-devel-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-devel-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-doc-0:4.18.0-193.28.1.el8_2.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-extra-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-extra-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-extra-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-extra-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-devel-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-devel-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-devel-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-core-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-devel-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-modules-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-modules-extra-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-193.28.1.el8_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-147.32.1.el8_1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-abi-whitelists-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-core-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-aarch64-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-s390x-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-doc-0:4.18.0-147.32.1.el8_1.noarch as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-extra-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-devel-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-core-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-devel-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-modules-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-zfcpdump-modules-extra-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat CodeReady Linux Builder EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-147.32.1.el8_1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 8.1)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-0:4.18.0-193.28.1.rt13.77.el8_2.src as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-0:4.18.0-193.28.1.rt13.77.el8_2.src as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-core-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-core-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-core-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-core-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-debuginfo-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-debuginfo-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-devel-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-devel-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-kvm-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-modules-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-modules-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-modules-extra-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debug-modules-extra-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debuginfo-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debuginfo-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debuginfo-common-x86_64-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-debuginfo-common-x86_64-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-devel-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-devel-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-kvm-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-modules-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-modules-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-modules-extra-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-rt-modules-extra-0:4.18.0-193.28.1.rt13.77.el8_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV (v. 8)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundbpftool-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-80.31.1.el8_0.src as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-abi-whitelists-0:4.18.0-80.31.1.el8_0.noarch as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-core-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-core-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-core-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-core-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-devel-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-devel-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-extra-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debug-modules-extra-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-ppc64le-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-debuginfo-common-x86_64-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-devel-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-devel-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-doc-0:4.18.0-80.31.1.el8_0.noarch as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-extra-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-modules-extra-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundkernel-tools-libs-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundperf-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-80.31.1.el8_0.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html
Workaroundpython3-perf-debuginfo-0:4.18.0-80.31.1.el8_0.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v. 8.0)redhat_csaf
If the CAP_NET_RAW capability disabled by default (which is true for Red Hat Enterprise Linux), then only a privileged user can trigger this bug. The mitigation is to disable CAP_NET_RAW capability for regular users and for executables. On Red Hat Enterprise Linux 8 CAP_NET_RAW capability can be also gained by exploiting unprivileged user namespaces. The mitigation is to disable unprivileged user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf OpenShift Container Platform 4.5 and 4.4 this can be mitigated by removing `CAP_NET_RAW` from the default cri-o capabilities provided to pods (NOTE: This may prevent `ping` from working in unprivileged pods. This fix has not been validated for OpenShift 4.3 or below): ``` apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: worker name: 50-reset-crio-capabilities spec: config: ignition: version: 2.2.0 storage: files: - contents: source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZV0KZGVmYXVsdF9jYXBhYmlsaXRpZXMgPSBbCiAgICAiQ0hPV04iLAogICAgIkRBQ19PVkVSUklERSIsCiAgICAiRlNFVElEIiwKICAgICJGT1dORVIiLAogICAgIlNFVEdJRCIsCiAgICAiU0VUVUlEIiwKICAgICJTRVRQQ0FQIiwKICAgICJORVRfQklORF9TRVJWSUNFIiwKICAgICJTWVNfQ0hST09UIiwKICAgICJLSUxMIiwKXQo= filesystem: root mode: 0644 path: /etc/crio/crio.conf.d/reset-crio-capabilities.conf ``` Create this MachineConfig object via e.g. `oc apply`. More information about MachineConfig can be found here: https://github.com/openshift/machine-config-operator https://docs.openshift.com/container-platform/4.5/architecture/architecture-rhcos.html In order to monitor the rollout of this change, use `oc describe machineconfigpool/worker`. Check for any pods which start to crash after this is applied; they may need to be adjusted request `CAP_NET_RAW` explicitly. More information: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container https://docs.openshift.com/container-platform/4.5/authentication/managing-security-context-constraints.html

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.7–7.8

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 3.9 · impact 10

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · secalert@redhat.com USexploitability 0.8 · impact 5.9

v3.17.4highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USprimaryCWE-250USCWE-250USCWE-786USCWE-787US

exploits (1)

Public proof-of-concept and weaponised exploit code.

cgwalters/cve-2020-14386cgwalters/cve-2020-14386PoC · poc_in_github

affected products (70)

Products and version ranges known to be affected.

Linux kernel Kernel≤ before 5.9-rc4enisa_euvdEU
АО «ИВК» Альт 8 СПall versionsfstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.4fstec_bduRU
ООО "Открытая мобильная платформа" ОС Аврора≤ 3.2.3.10fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.6 «Смоленск»fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 9fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 8fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU
Сообщество свободного программного обеспечения Linux4.10 → 4.14.200fstec_bduRU
Сообщество свободного программного обеспечения Linux4.15 → 4.19.149fstec_bduRU
Сообщество свободного программного обеспечения Linux4.20 → 5.4.63fstec_bduRU
Сообщество свободного программного обеспечения Linux4.6 → 4.9.238fstec_bduRU
Сообщество свободного программного обеспечения Linux5.5 → 5.8.7fstec_bduRU
debian debian linux= 9.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
fedoraproject fedora= 33nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
linux linux kernel4.10 → 4.14.201nvdUScpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux kernel4.15 → 4.19.150nvdUScpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux kernel4.20 → 5.4.64nvdUScpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux kernel4.6 → 4.9.239nvdUScpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

showing 20 of 70

advisories (4)

Vendor and ecosystem advisories describing this.

RHSA-2020:4286Red Hat Security Advisory: kernel security and bug fix update2020-10-20csaf · redhat_csafUS
An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2020:4287Red Hat Security Advisory: kernel security and bug fix update2020-10-20csaf · redhat_csafUS
An update for kernel is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2020:4289Red Hat Security Advisory: kernel-rt security and bug fix update2020-10-20csaf · redhat_csafUS
An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2020:5199Red Hat Security Advisory: kernel security update2020-11-24csaf · redhat_csafUS
An update for kernel is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd redhat_csaf NVD CVE.org MITRE

published 2020-09-16modified 2026-06-17

related (16,097)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-86950US	—OT critical	26.2% (98th)	KEV	2026-09-28
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1,…
CVE-2026-87491US	—OT critical	3.51% (89th)	KEV	2026-09-09
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security…
CVE-2026-53362US	—OT critical	0.71% (53rd)	KEV	2026-07-04
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branc…
CVE-2026-53266US	—OT critical	0.93% (61st)	KEV	2026-06-25
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source addre…
CVE-2026-11645US	—OT critical	2.44% (84th)	KEV	2026-06-09
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium…

+16092 more

references (55)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan