Security Bulletin: IBM Cloud Private is affected by an issue with runc used by Docker

Upgrade Docker Engine on IBM Cloud Automation Manager Content Runtime system for CVE 2019-5736

IBM Cloud Automation Manager Content Runtime deployment installs either Docker CE or Docker EE on the Content Runtime system based on user selection. Docker CE is installed either using Docker provided convenience scripts or using the installation binary provided by the user. Docker EE is installed using the Docker EE repository URL provided by the user or the installation binary provided by the user.

This instruction assumes that you already upgraded your docker engine for CVE 2018-10892 https://www-01.ibm.com/support/docview.wss?uid=ibm10739839. After applying the fix for CVE 2018-10892, you must be either, running Docker CE 18.06 or 18.09, or Docker EE 18.03 or 18.09

To fix the vulnerability described in CVE 2019-5736, you need to upgrade your

• Docker CE version 18.06.x to 18.06.3 or higher
• Docker CE version 18.09.x to 18.09.2 or higher
• Docker EE version 18.03.x to 18.03.1-ee.6 or higher
• Docker EE version 18.09.x to 18.09.2 or higher

Before you upgrade the Docker Engine:

docker version

If the version is lower than Docker CE 18.06.3, Docker CE 18.09.2, Docker EE 18.03.1-ee.6 or Docker EE 18.09.2 then you need to upgrade.

cd /root/advanced-content-runtime

docker-compose -f docker-compose.yml down

Note: If you are running Docker 18.06.x or lower, then do not upgrade to 18.09 or higher. Starting from Docker 18.09 the devicemapper storage driver is deprecated. The content runtime deployments that use Docker 18.06.x or lower use devicemapper storage driver.

Upgrade Docker CE on Ubuntu

sudo apt-get update

sudo apt-cache madison docker-ce

For 18.06 or lower use the following command

   sudo apt-get install docker-ce=<VERSION>

   For 18.09 use the following command

sudo apt-get install docker-ce=<VERSION_STRING> docker-ce-cli=<VERSION_STRING> containerd.io

       where version_string is the second column from output of step 2

   Example: 

   sudo apt-get install docker-ce=18.06.3~ce~3-0~ubuntu

   or

sudo apt-get install docker-ce= 5:18.09.3~3-0~ubuntu-xenial docker-ce-cli= 5:18.09.3~3-0~ubuntu-xenial containerd.io

sudo docker version

cd /root/advanced-content-runtime

docker-compose -f docker-compose.yml up -d

sudo docker ps

For more details on install and upgrade of Docker CE on Ubuntu refer to https://docs.docker.com/install/linux/docker-ce/ubuntu/

Upgrade Docker EE on Ubuntu

sudo add-apt-repository "deb [arch=amd64] <YOUR_DOCKER_EE_REPO_URL>/ubuntu <YOUR_UBUNTU_VERSION> stable-18.03"

or

sudo add-apt-repository "deb [arch=amd64] <YOUR_DOCKER_EE_REPO_URL>/ubuntu <YOUR_UBUNTU_VERSION> stable-18.09"

Example: "sudo add-apt-repository "deb [arch=amd64] https://storebits.docker.com/ee/trial/sub-xxx-xxx-xxx-xxx-xxx/ubuntu_xenial_stable-18.03" "

Example: "sudo add-apt-repository "deb [arch=amd64] https://storebits.docker.com/ee/trial/sub-xxx-xxx-xxx-xxx-xxx/ubuntu_xenial_stable-18.09" "

sudo apt-get update

sudo apt-cache madison docker-ee

To upgrade 18.03 execute: 

sudo apt-get install docker-ee=<VERSION>

To upgrade 18.09 execute: 

sudo apt-get install docker-ee=<VERSION_STRING> docker-ee-cli=<VERSION_STRING> containerd.io      

Where version_string is the second column from output of step 3

   Example: sudo apt-get install docker-ee=3:18.03.1~ee~3~3-0~ubuntu

Example: sudo apt-get install docker-ee= 5:18.09.3~3-0~ubuntu-xenial docker-ee-cli= 5:18.09.3~3-0~ubuntu-xenial containerd.io

sudo docker version

cd /root/advanced-content-runtime

docker-compose -f docker-compose.yml up -d

sudo docker ps

For more details on install and upgrade of Docker EE on Ubuntu refer to https://docs.docker.com/install/linux/docker-ee/ubuntu/

Upgrade Docker EE on Red Hat Linux

                       sudo yum-config-manager --enable docker-ee-stable-18.03 or

       sudo yum-config-manager --enable docker-ee-stable-18.09

         sudo yum list docker-ee --showduplicates | sort -r

To upgrade 18.03 execute: 

         sudo yum -y install docker-ee-<version_string>

To upgrade 18.09 execute: 

sudo yum -y install docker-ee-< version_string > docker-ee-cli-< version_string > containerd.io

where version_string is the second column from output of step 2 starting at the first colon (:), up to the first hyphen.

Example: sudo yum -y install docker-ee-18.09.3 docker-ee-cli-18.09.3 containerd.io

Example: sudo yum -y install docker-ee-18.03.1.ee.7

sudo docker version

cd /root/advanced-content-runtime

docker-compose -f docker-compose.yml up -d

sudo docker ps

For more details on install and upgrade of Docker EE on Red Hat Linux refer to https://docs.docker.com/install/linux/docker-ee/rhel/

Upgrade Docker installed using binary files

If you installed Docker on Content Runtime virtual machine using the Docker Installation file option during Content Runtime deployment, then you need to download the debian or rpm package from Docker and upgrade the package. 

For more information, depending on your operating system and Docker Engine Edition, refer to Upgrade section in one of the following links

https://docs.docker.com/install/linux/docker-ce/ubuntu/#install-from-a-package, 
https://docs.docker.com/install/linux/docker-ee/rhel/#install-with-a-package, or 
https://docs.docker.com/install/linux/docker-ee/ubuntu/#install-from-a-package .

Note: If you are running Docker 18.06.x or lower, then do not upgrade to 18.09 or higher. Starting from Docker 18.09 the devicemapper storage driver is deprecated. The content runtime deployments that use Docker 18.06.x or lower use devicemapper storage driver.

For Ubuntu execute the following steps

sudo dpkg -i <PATH_TO_UPGRADE_PACKAGE>

   docker version

cd /root/advanced-content-runtime

docker-compose -f docker-compose.yml up -d

docker ps

For Red Hat execute the following steps

sudo yum -y upgrade <PATH_TO_UPGRADE_PACKAGE>

   docker version

cd /root/advanced-content-runtime

docker-compose -f docker-compose.yml up -d

docker ps