Flatcar Container Linux Release - 2022-06-22

# Flatcar Container Linux Release - 2022-06-22 ## alpha-3277.0.0 - AMD64-usr - Platforms succeeded: All - Platforms failed: None - Platforms not tested: None - ARM64-usr - Platforms succeeded: All - Platforms failed: None - Platforms not tested: None VERDICT: _GO_ ## beta-3227.1.1 - AMD64-usr - Platforms succeeded: All - Platforms failed: None - Platforms not tested: None - ARM64-usr - Platforms succeeded: All - Platforms failed: None - Platforms not tested: None VERDICT: _GO_ ## stable-3139.2.3 - AMD64-usr - Platforms succeeded: All - Platforms failed: None - Platforms not tested: None - ARM64-usr - Platforms succeeded: All - Platforms failed: None - Platforms not tested: None VERDICT: _GO_ ## lts-3033.3.2 - AMD64-usr - Platforms succeeded: All - Platforms failed: cl.locksmith.cluster is flaky on EM - Platforms not tested: None - ARM64-usr - Platforms succeeded: All - Platforms failed: None - Platforms not tested: None VERDICT: _GO_ ## lts-2605.29.1 - AMD64-usr - Platforms succeeded: All - Platforms failed: cl.locksmith.cluster is flaky on EM - Platforms not tested: None - ARM64-usr - Platforms succeeded: All - Platforms failed: None - Platforms not tested: None VERDICT: _GO_ ## Communication --- #### Guidelines / Things to Remember - Release notes are used in a PR and will appear on https://www.flatcar-linux.org/releases/ - [Announcement Message](#Announcement-Message) is posted in [Flatcar-Linux-user](https://groups.google.com/g/flatcar-linux-user). Make sure to post as “Flatcar Container Linux User”, not with your personal user (this can be selected when drafting the post). - Make sure the the LTS (channel) is referred to as `LTS-2022`, and not `LTS-3033` --- ### Announcement Message Subject: Announcing new Alpha 3277.0.0, Beta 3227.1.1, Stable 3139.2.3, LTS-2022 3033.3.2, LTS-2021 2605.29.1 releases. Hello, We are pleased to announce new Flatcar Container Linux releases for the Alpha, Beta, Stable, LTS-2022 and LTS-2021 channels. # New **Alpha** Release **3277.0.0** Changes since alpha-3255.0.0 ## Security fixes: - Linux ([CVE-2022-1789](https://nvd.nist.gov/vuln/detail/CVE-2022-1789), [CVE-2022-1852](https://nvd.nist.gov/vuln/detail/CVE-2022-1852), [CVE-2022-1972](https://nvd.nist.gov/vuln/detail/CVE-2022-1972), [CVE-2022-1973](https://nvd.nist.gov/vuln/detail/CVE-2022-1973), [CVE-2022-2078](https://nvd.nist.gov/vuln/detail/CVE-2022-2078), [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250), [CVE-2022-32981](https://nvd.nist.gov/vuln/detail/CVE-2022-32981)) - containerd ([CVE-2022-31030](https://nvd.nist.gov/vuln/detail/CVE-2022-31030)) - ignition ([CVE-2022-1706](https://nvd.nist.gov/vuln/detail/CVE-2022-1706)) - intel-microcode ([CVE-2022-21151](https://nvd.nist.gov/vuln/detail/CVE-2022-21151)) - libpcre2 ([CVE-2022-1586](https://nvd.nist.gov/vuln/detail/CVE-2022-1586), [CVE-2022-1587](https://nvd.nist.gov/vuln/detail/CVE-2022-1587)) - libxml2 ([CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)) ## Bug fixes: ## Changes: - Added efibootmgr binary to the image ([coreos-overlay#1955](https://github.com/flatcar-linux/coreos-overlay/pull/1955)) - Enabled `containerd.service` unit, `br_netfilter` and `overlay` modules by default to follow Kubernetes requirements ([coreos-overlay#1944](https://github.com/flatcar-linux/coreos-overlay/pull/1944), [init#72](https://github.com/flatcar-linux/init/pull/72)) - flatcar-install: Added option to create UEFI boot entry ([init#74](https://github.com/flatcar-linux/init/pull/74)) - ARM64: Added [cifs-utils](https://wiki.samba.org/index.php/LinuxCIFS_utils) for ARM64 - ARM64: Added [sssd](https://sssd.io/), [adcli](https://www.freedesktop.org/software/realmd/adcli/adcli.html) and realmd for ARM64 - SDK / ARM64: Added [go-tspi](https://pkg.go.dev/github.com/coreos/go-tspi) bindings for ARM64 - VMWare: Added `ignition-delete-config.service` to remove Ignition config from VM metadata, see also [here](https://coreos.github.io/ignition/operator-notes/#automatic-config-deletion) ([coreos-overlay#1948](https://github.com/flatcar-linux/coreos-overlay/pull/1948)) ## Updates: - Linux ([5.15.48](https://lwn.net/Articles/898124) (includes [5.15.47](https://lwn.net/Articles/897904), [5.15.46](https://lwn.net/Articles/897377), [5.15.45](https://lwn.net/Articles/897167), [5.15.44](https://lwn.net/Articles/896647))) - Linux Firmware ([20220610](https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tag/?h=20220610)) - Docker ([20.10.17](https://docs.docker.com/engine/release-notes/#201017)) - ca-certificates ([3.79](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_79.html)) - containerd ([1.6.6](https://github.com/containerd/containerd/releases/tag/v1.6.6)) - ignition ([2.14.0](https://github.com/coreos/ignition/releases/tag/v2.14.0)) - intel-microcode ([20220510](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20220510)) - runc ([1.1.3](https://github.com/opencontainers/runc/releases/tag/v1.1.3)) - libpcre2 ([10.40](https://github.com/PCRE2Project/pcre2/blob/pcre2-10.40/NEWS)) - libxml2 ([2.9.14](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14)) # New **Beta** Release **3227.1.1** Changes since beta-3227.1.0 ## Security fixes: - Linux ([CVE-2022-1789](https://nvd.nist.gov/vuln/detail/CVE-2022-1789), [CVE-2022-1852](https://nvd.nist.gov/vuln/detail/CVE-2022-1852), [CVE-2022-1972](https://nvd.nist.gov/vuln/detail/CVE-2022-1972), [CVE-2022-1973](https://nvd.nist.gov/vuln/detail/CVE-2022-1973), [CVE-2022-2078](https://nvd.nist.gov/vuln/detail/CVE-2022-2078), [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250), [CVE-2022-32981](https://nvd.nist.gov/vuln/detail/CVE-2022-32981)) - containerd ([CVE-2022-31030](https://nvd.nist.gov/vuln/detail/CVE-2022-31030)) - libpcre2 ([CVE-2022-1586](https://nvd.nist.gov/vuln/detail/CVE-2022-1586), [CVE-2022-1587](https://nvd.nist.gov/vuln/detail/CVE-2022-1587)) ## Bug fixes: ## Changes: - ARM64: Added [cifs-utils](https://wiki.samba.org/index.php/LinuxCIFS_utils) for ARM64 - ARM64: Added [sssd](https://sssd.io/), [adcli](https://www.freedesktop.org/software/realmd/adcli/adcli.html) and realmd for ARM64 - SDK / ARM64: Added [go-tspi](https://pkg.go.dev/github.com/coreos/go-tspi) bindings for ARM64 ## Updates: - Linux ([5.15.48](https://lwn.net/Articles/898124) (includes [5.15.47](https://lwn.net/Articles/897904), [5.15.46](https://lwn.net/Articles/897377), [5.15.45](https://lwn.net/Articles/897167), [5.15.44](https://lwn.net/Articles/896647))) - ca-certificates ([3.79](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_79.html)) - containerd ([1.6.6](https://github.com/containerd/containerd/releases/tag/v1.6.6)) - libpcre2 ([10.40](https://github.com/PCRE2Project/pcre2/blob/pcre2-10.40/NEWS)) # New **Stable** Release **3139.2.3** Changes since stable-3139.2.2 ## Security fixes: - Linux ([CVE-2022-1789](https://nvd.nist.gov/vuln/detail/CVE-2022-1789), [CVE-2022-1852](https://nvd.nist.gov/vuln/detail/CVE-2022-1852), [CVE-2022-1972](https://nvd.nist.gov/vuln/detail/CVE-2022-1972), [CVE-2022-1973](https://nvd.nist.gov/vuln/detail/CVE-2022-1973), [CVE-2022-2078](https://nvd.nist.gov/vuln/detail/CVE-2022-2078), [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250), [CVE-2022-32981](https://nvd.nist.gov/vuln/detail/CVE-2022-32981)) - libpcre2 ([CVE-2022-1586](https://nvd.nist.gov/vuln/detail/CVE-2022-1586), [CVE-2022-1587](https://nvd.nist.gov/vuln/detail/CVE-2022-1587)) ## Bug fixes: ## Changes: ## Updates: - Linux ([5.15.48](https://lwn.net/Articles/898124) (includes [5.15.47](https://lwn.net/Articles/897904), [5.15.46](https://lwn.net/Articles/897377), [5.15.45](https://lwn.net/Articles/897167), [5.15.44](https://lwn.net/Articles/896647))) - ca-certificates ([3.79](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_79.html)) - libpcre2 ([10.40](https://github.com/PCRE2Project/pcre2/blob/pcre2-10.40/NEWS)) # New **LTS-2022** Release **3033.3.2** Changes since lts-3033.3.1 ## Security fixes: - Linux ([CVE-2022-1012](https://nvd.nist.gov/vuln/detail/CVE-2022-1012), [CVE-2022-1789](https://nvd.nist.gov/vuln/detail/CVE-2022-1789), [CVE-2022-1852](https://nvd.nist.gov/vuln/detail/CVE-2022-1852), [CVE-2022-1972](https://nvd.nist.gov/vuln/detail/CVE-2022-1972), [CVE-2022-2078](https://nvd.nist.gov/vuln/detail/CVE-2022-2078), [CVE-2022-21499](https://nvd.nist.gov/vuln/detail/CVE-2022-21499), [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250), [CVE-2022-32981](https://nvd.nist.gov/vuln/detail/CVE-2022-32981)) - libpcre2 ([CVE-2022-1586](https://nvd.nist.gov/vuln/detail/CVE-2022-1586), [CVE-2022-1587](https://nvd.nist.gov/vuln/detail/CVE-2022-1587)) ## Bug fixes: ## Changes: ## Updates: - Linux ([5.10.123](https://lwn.net/Articles/898125) (includes [5.10.122](https://lwn.net/Articles/897903), [5.10.121](https://lwn.net/Articles/897378), [5.10.120](https://lwn.net/Articles/897168), [5.10.119](https://lwn.net/Articles/896648)) - ca-certificates ([3.79](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_79.html)) - libpcre2 ([10.40](https://github.com/PCRE2Project/pcre2/blob/pcre2-10.40/NEWS)) # New **LTS-2021** Release **2605.29.1** Changes since lts-2605.28.1 ## Security fixes: - Linux ([CVE-2022-1012](https://nvd.nist.gov/vuln/detail/CVE-2022-1012), [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250), [CVE-2022-21499](https://nvd.nist.gov/vuln/detail/CVE-2022-21499), [CVE-2022-32981](https://nvd.nist.gov/vuln/detail/CVE-2022-32981)) ## Bug fixes: ## Changes: ## Updates: - Linux ([5.4.199](https://lwn.net/Articles/898126) (includes [5.4.198](https://lwn.net/Articles/897902), [5.4.197](https://lwn.net/Articles/897169))) - ca-certificates ([3.79](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_79.html)) Best, The Flatcar Container Linux Maintainers --- ### Security **Subject**: Security issues fixed with the latest Alpha 3277.0.0, Beta 3227.1.1, Stable 3139.2.3, LTS-2022 3033.3.2, LTS-2021 2605.29.1 releases **Security fix**: With the Alpha 3277.0.0, Beta 3227.1.1, Stable 3139.2.3, LTS-2022 3033.3.2, LTS-2021 2605.29.1 releases we ship a fix for the CVEs listed below. #### Alpha * Linux * [CVE-2022-1789](https://nvd.nist.gov/vuln/detail/CVE-2022-1789) CVSSv3 score: 6.8(Medium) With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference. * [CVE-2022-2078](https://nvd.nist.gov/vuln/detail/CVE-2022-2078) CVSSv3 score: n/a * [CVE-2022-1852](https://nvd.nist.gov/vuln/detail/CVE-2022-1852) CVSSv3 score: n/a * [CVE-2022-1972](https://nvd.nist.gov/vuln/detail/CVE-2022-1972) CVSSv3 score: n/a * [CVE-2022-1973](https://nvd.nist.gov/vuln/detail/CVE-2022-1973) CVSSv3 score: n/a * [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250) CVSSv3 score: 7.8(High) net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. * [CVE-2022-32981](https://nvd.nist.gov/vuln/detail/CVE-2022-32981) CVSSv3 score: n/a An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. * containerd * [CVE-2022-31030](https://nvd.nist.gov/vuln/detail/CVE-2022-31030) CVSSv3 score: n/a containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used. * ignition * [CVE-2022-1706](https://nvd.nist.gov/vuln/detail/CVE-2022-1706) CVSSv3 score: 6.5(Medium) A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config. * intel-microcode * [CVE-2022-21151](https://nvd.nist.gov/vuln/detail/CVE-2022-21151) CVSSv3 score: 5.5(Medium) Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. * libpcre2 * [CVE-2022-1586](https://nvd.nist.gov/vuln/detail/CVE-2022-1586) CVSSv3 score: 9.1(Critical) An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT. * [CVE-2022-1587](https://nvd.nist.gov/vuln/detail/CVE-2022-1587) CVSSv3 score: 9.1(Critical) An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. * libxml2 * [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824) CVSSv3 score: 6.5(Medium) In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well. #### Beta * Linux * [CVE-2022-1789](https://nvd.nist.gov/vuln/detail/CVE-2022-1789) CVSSv3 score: 6.8(Medium) With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference. * [CVE-2022-1852](https://nvd.nist.gov/vuln/detail/CVE-2022-1852) CVSSv3 score: n/a * [CVE-2022-1972](https://nvd.nist.gov/vuln/detail/CVE-2022-1972) CVSSv3 score: n/a * [CVE-2022-1973](https://nvd.nist.gov/vuln/detail/CVE-2022-1973) CVSSv3 score: n/a * [CVE-2022-2078](https://nvd.nist.gov/vuln/detail/CVE-2022-2078) CVSSv3 score: n/a * [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250) CVSSv3 score: 7.8(High) net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. * [CVE-2022-32981](https://nvd.nist.gov/vuln/detail/CVE-2022-32981) CVSSv3 score: n/a An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. * containerd * [CVE-2022-31030](https://nvd.nist.gov/vuln/detail/CVE-2022-31030) CVSSv3 score: n/a containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used. * libpcre2 * [CVE-2022-1586](https://nvd.nist.gov/vuln/detail/CVE-2022-1586) CVSSv3 score: 9.1(Critical) An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT. * [CVE-2022-1587](https://nvd.nist.gov/vuln/detail/CVE-2022-1587) CVSSv3 score: 9.1(Critical) An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. #### Stable * Linux * [CVE-2022-1789](https://nvd.nist.gov/vuln/detail/CVE-2022-1789) CVSSv3 score: 6.8(Medium) With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference. * [CVE-2022-1852](https://nvd.nist.gov/vuln/detail/CVE-2022-1852) CVSSv3 score: n/a * [CVE-2022-1972](https://nvd.nist.gov/vuln/detail/CVE-2022-1972) CVSSv3 score: n/a * [CVE-2022-1973](https://nvd.nist.gov/vuln/detail/CVE-2022-1973) CVSSv3 score: n/a * [CVE-2022-2078](https://nvd.nist.gov/vuln/detail/CVE-2022-2078) CVSSv3 score: n/a * [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250) CVSSv3 score: 7.8(High) net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. * [CVE-2022-32981](https://nvd.nist.gov/vuln/detail/CVE-2022-32981) CVSSv3 score: n/a An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. * libpcre2 * [CVE-2022-1586](https://nvd.nist.gov/vuln/detail/CVE-2022-1586) CVSSv3 score: 9.1(Critical) An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT. * [CVE-2022-1587](https://nvd.nist.gov/vuln/detail/CVE-2022-1587) CVSSv3 score: 9.1(Critical) An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. #### LTS-2022 * Linux * [CVE-2022-1012](https://nvd.nist.gov/vuln/detail/CVE-2022-1012) CVSSv3 score: n/a * [CVE-2022-1789](https://nvd.nist.gov/vuln/detail/CVE-2022-1789) CVSSv3 score: 6.8(Medium) With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference. * [CVE-2022-1852](https://nvd.nist.gov/vuln/detail/CVE-2022-1852) CVSSv3 score: n/a * [CVE-2022-1972](https://nvd.nist.gov/vuln/detail/CVE-2022-1972) CVSSv3 score: n/a * [CVE-2022-2078](https://nvd.nist.gov/vuln/detail/CVE-2022-2078) CVSSv3 score: n/a * [CVE-2022-21499](https://nvd.nist.gov/vuln/detail/CVE-2022-21499) CVSSv3 score: 6.7(Medium) KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). * [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250) CVSSv3 score: n/a net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. * [CVE-2022-32981](https://nvd.nist.gov/vuln/detail/CVE-2022-32981) CVSSv3 score: n/a An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. * libpcre2 * [CVE-2022-1586](https://nvd.nist.gov/vuln/detail/CVE-2022-1586) CVSSv3 score: 9.1(Critical) An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT. * [CVE-2022-1587](https://nvd.nist.gov/vuln/detail/CVE-2022-1587) CVSSv3 score: 9.1(Critical) An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. #### LTS-2021 * Linux * [CVE-2022-1012](https://nvd.nist.gov/vuln/detail/CVE-2022-1012) CVSSv3 score: n/a N/A * [CVE-2022-21499](https://nvd.nist.gov/vuln/detail/CVE-2022-21499) CVSSv3 score: 6.5(Medium) KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. * [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250) CVSSv3 score: 7.8(High) net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. * [CVE-2022-32981](https://nvd.nist.gov/vuln/detail/CVE-2022-32981) CVSSv3 score: n/a An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers. Best, The Flatcar Container Linux Maintainers --- ### Communication #### Twitter _The tweet (from [@flatcar](https://twitter.com/flatcar)) goes out after the changelog update has been published; it includes a link to the web changelog._ June's Flatcar release! 📦 Package upgrades to cover multiple CVEs 🚀 A new feature implemented by a community member (thanks @jbguerraz!) 📜 Release notes in usual spot: https://www.flatcar.org/releases/ #### Kubernetes Slack _This goes in the #flatcar channel_ Please welcome this month Flatcar releases: - Alpha 3277.0.0 (new major) - Beta 3227.1.1 (maintenance release) - Stable 3139.2.3 (maintenance release) - LTS-2022 3033.3.2 and LTS-2021 2605.29.1 (maintenance release) These releases include: 🚀 A new feature implemented by a community member 🩹 Added missing pieces to ARM64 📦 Package upgrades to cover CVE 📜 Release notes in usual spot: https://www.flatcar.org/releases/

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.