Container Optimized OS 97 - Release notes

March 27, 2024

2024-03-27T00:00:00-07:00

Change

cos-97-16919-450-41

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.208	v20.10.24	v1.6.21	v470.239.06(default),v535.161.07(latest)

Security

Fixed CVE-2023-52443 in the Linux kernel.

Security

Fixed CVE-2024-26585 in the Linux kernel.

Security

Fixed CVE-2024-26589 in the Linux kernel.

Security

Fixed CVE-2023-52435 in the Linux kernel.

Security

Fixed CVE-2023-52434 in the Linux kernel.

Security

Fixed CVE-2023-52439 in the Linux kernel.

Fixed

Fixed bug in google-guest-agent service enablement.

March 20, 2024

2024-03-20T00:00:00-07:00

Change

cos-97-16919-450-34

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.208	v20.10.24	v1.6.21	v470.239.06(default),v535.161.07(latest)

Security

Updated app-editors/vim to 9.0.2167. This fixed CVE-2023-48231, CVE-2023-48232, CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237, CVE-2023-48706, CVE-2024-22667.

Security

Fixed CVE-2024-0727 in dev-libs/openssl.

Security

Fixed CVE-2023-52447 in the Linux kernel.

March 11, 2024

2024-03-11T00:00:00-07:00

Change

cos-97-16919-450-30

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.208	v20.10.24	v1.6.21	v470.239.06(default),v535.161.07(latest)

Feature

Updated cos-gpu-installer to v2.2.1. Fixed cached driver installation error with network disabled. Added force-fallback flag, major version specification for GPU driver installation and fixed ordering of kernel module loading for nvidia-modeset and nvidia-drm

Security

Updated NVIDIA GPU drivers to v470.239.06 and v535.161.07. This fixes CVE-2024-0074, CVE-2024-0075 and CVE-2022-42265.

March 07, 2024

2024-03-07T00:00:00-08:00

Change

cos-97-16919-450-26

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.208	v20.10.24	v1.6.21	v470.223.02 (default),v535.154.05(latest),v470.223.02(R470 for compatibility with K80 GPUs)

Security

Fixed CVE-2022-3567 in the Linux kernel.

Security

Fixed CVE-2022-3566 in the Linux kernel.

Security

Updated dev-libs/libxml2 to version 2.11.7. This fixes CVE-2024-25062.

Security

Fixed CVE-2024-23851 in the Linux kernel.

Security

Fixed CVE-2024-26581 in the Linux kernel.

Security

Upgraded net-misc/curl to version 8.6.0. This fixes CVE-2024-0853.

February 12, 2024

2024-02-12T00:00:00-08:00

Change

cos-97-16919-450-16

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.208	v20.10.24	v1.6.21	v470.223.02 (default),v535.154.05(latest),v470.223.02(R470 for compatibility with K80 GPUs)

Security

Fixed CVE-2023-5678 in dev-libs/openssl.

Security

Fixed CVE-2024-1086 and CVE-2023-46838 in the linux kernel.

Security

Fixed CVE-2024-0567 and CVE-2024-0553 in net-libs/gnutls.

Security

Fixed CVE-2023-40546, CVE-2023-40547, CVE-2023-40549 and CVE-2023-40551 in sys-boot/shim.

Feature

Fragmented nvidia-drivers and nvidia-drivers-open pkg into separate packages per major version.

February 05, 2024

2024-02-05T00:00:00-08:00

Change

cos-97-16919-450-7

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.208	v20.10.24	v1.6.21	v470.223.02 (default),v535.154.05(latest),v470.223.02(R470 for compatibility with K80 GPUs)

Security

Fixed CVE-2023-6915 in the Linux kernel.

Change

Updated cos-gpu-installer to v2.1.10.

January 31, 2024

2024-01-31T00:00:00-08:00

Change

cos-97-16919-450-6

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.208	v20.10.24	v1.6.21	v470.223.02 (default),v535.154.05(latest),v470.223.02(R470 for compatibility with K80 GPUs)

Announcement

This is an LTS Refresh release.

Change

Updated cos-gpu-installer to v2.1.10.

Security

Fixed CVE-2024-22195 in dev-python/jinja.

Security

Fixed CVE-2023-3164 in sys-apps/gawk.

Security

Fixed CVE-2024-21626 in app-emulation/runc.

Change

Updated latest NVIDIA GPU driver to 535.154.05.

Change

Runtime sysctl changes:

Added: net.ipv6.conf.all.accept_ra_min_lft: 0
Added: net.ipv6.conf.default.accept_ra_min_lft: 0
Added: net.ipv6.conf.docker0.accept_ra_min_lft: 0
Added: net.ipv6.conf.eth0.accept_ra_min_lft: 0
Added: net.ipv6.conf.lo.accept_ra_min_lft: 0
Changed: fs.file-max: 813422 -> 813419
Changed: net.ipv6.route.max_size: 4096 -> 2147483647

January 16, 2024

2024-01-16T00:00:00-08:00

Change

cos-97-16919-404-34

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs)

Security

Fixed CVE-2023-48795 in net-misc/openssh.

Security

Upgraded dev-db/sqlite to v3.44.2-r2. This fixes CVE-2023-7104.

January 08, 2024

2024-01-08T00:00:00-08:00

Change

cos-97-16919-404-33

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs)

Security

Fixed CVE-2023-51385 in net-misc/openssh.

Security

Upgraded sys-apps/dbus to v1.12.28. This fixes CVE-2023-34969, CVE-2022-42012, CVE-2022-42011 and CVE-2022-42010.

January 02, 2024

2024-01-02T00:00:00-08:00

Change

cos-97-16919-404-31

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs)

Security

Fixed CVE-2023-6931 in the Linux kernel.

Fixed

Updated docker-credential-gcr to v2.1.21.

Security

Fixed CVE-2023-6932 in the Linux kernel.

Security

Updated net-misc/curl to v8.5.0. This resolves CVE-2023-46218.

December 19, 2023

2023-12-19T00:00:00-08:00

Change

cos-97-16919-404-26

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs)

Fixed

Fixed a container performance issue that occurred after running systemctl start cloud-audit-setup.

December 04, 2023

2023-12-04T00:00:00-08:00

Change

cos-97-16919-404-21

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs)

Security

Fixed CVE-2023-46862 in the Linux kernel.

November 29, 2023

2023-11-29T00:00:00-08:00

Change

cos-97-16919-404-19

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.223.02 (default),v535.129.03(latest),v470.223.02(R470 for compatibility with K80 GPUs)

Security

Updated dev-libs/libxml2 to v2.11.5. This resolves CVE-2023-45322.

Feature

Updated NVIDIA GPU drivers. This resolves CVE-2023-31022.

November 15, 2023

2023-11-15T00:00:00-08:00

Change

cos-97-16919-404-17

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.199.02(default),v535.104.12(latest)

Security

Updated net-libs/nghttp2 to v1.57.0. This resolves CVE-2023-44487 and CVE-2023-35945.

Security

Updated app-editors/vim,app-editors/vim-core to v9.0.2092. This resolves CVE-2023-4733, CVE-2023-4734, CVE-2023-4735, CVE-2023-4736, CVE-2023-4738, CVE-2023-4750, CVE-2023-4752, CVE-2023-4781, CVE-2023-5344, CVE-2023-5441, CVE-2023-5535.

Security

Fixed CVE-2023-46813 in the Linux kernel.

November 14, 2023

2023-11-14T00:00:00-08:00

Change

cos-97-16919-404-17

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.199.02(default),v535.104.12(latest)

Security

Updated app-editors/vim,app-editors/vim-core to v9.0.2092. This resolves CVE-2023-4733, CVE-2023-4734, CVE-2023-4735, CVE-2023-4736 CVE-2023-4738, CVE-2023-4750, CVE-2023-4752, CVE-2023-4781 CVE-2023-5344, CVE-2023-5441, CVE-2023-5535.

Security

Updated net-libs/nghttp2 to v1.57.0. This resolves CVE-2023-44487 and CVE-2023-35945.

Security

Fixed CVE-2023-46813 in the Linux kernel.

November 07, 2023

2023-11-07T00:00:00-08:00

Change

cos-97-16919-404-13

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.199.02(default),v535.104.12(latest)

Security

Fixed CVE-2023-45863 in the Linux kernel.

Fixed

Updated google-guest-configs to 20230929.00.

Security

Fixed CVE-2023-42754 in the Linux kernel.

Security

Fixed CVE-2023-5717 in the Linux kernel.

October 30, 2023

2023-10-30T00:00:00-07:00

Change

cos-97-16919-404-9

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.199.02(default),v535.104.12(latest)

Feature

Enable portmapper registration reporting for lsof. This also fixes an issue where lsof is missing from SOS reports.

Fixed

Updated latest NVIDIA GPU drivers to v535.104.12.

October 24, 2023

2023-10-24T00:00:00-07:00

Change

cos-97-16919-404-4

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.197	v20.10.24	v1.6.21	v470.199.02(default),v535.104.05(latest)

Announcement

This is an LTS Refresh Release.

Change

Runtime sysctl changes:

Added: net.ipv4.tcp_migrate_req: 0
Changed: fs.file-max: 813432 -> 813422
Changed: net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd: 0 -> 3
Changed: net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent: 0 -> 3

Security

Upgraded net-misc/curl to version 8.4.0. This resolves CVE-2023-38545.

Security

Fix CVE-2023-42756 in COS kernel.

October 16, 2023

2023-10-16T00:00:00-07:00

Change

cos-97-16919-353-53

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.186	v20.10.24	v1.6.21	v470.199.02(default),v535.104.05(latest)

Security

Fixed CVE-2023-42753 in the Linux Kernel.

Fixed

Updated cos-gpu-installer to v2.1.9.

Security

Fixed CVE-2023-38039 in net-misc/curl.

October 11, 2023

2023-10-11T00:00:00-07:00

Change

cos-97-16919-353-53

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.186	v20.10.24	v1.6.21	v470.199.02(default),v535.104.05(latest)

Security

Fixed CVE-2023-38039 in net-misc/curl.

Security

Fixed CVE-2023-42753 in the Linux Kernel.

Fixed

Upgraded cos-gpu-installer to v2.1.9.

September 26, 2023

2023-09-26T00:00:00-07:00

Change

cos-97-16919-353-50

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.186	v20.10.24	v1.6.21	v470.199.02(default),v535.104.05

Fixed

Fixed an issue where IPv6 networking would fail under high CPU load.

Security

Fixed CVE-2023-4623 in the Linux kernel.

Security

Fixed CVE-2023-4921 in the Linux kernel.

September 18, 2023

2023-09-18T00:00:00-07:00

Change

cos-97-16919-353-46

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.186	v20.10.24	v1.6.21	v470.199.02(default),v535.104.05

Security

Fixed CVE-2023-4622 in the linux kernel.

September 11, 2023

2023-09-11T00:00:00-07:00

Change

cos-97-16919-353-44

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.186	v20.10.24	v1.6.21	v470.199.02(default),v535.104.05

Change

Updated cos-gpu-installer to v2.1.7. Switched precompiled driver and signature location to COS build artifacts.

Security

Fixed the following CVEs in sys-libs/binutils-libs: CVE-2022-47007 CVE-2022-47008, CVE-2022-47010, CVE-2022-47011, CVE-2022-48063, CVE-2022-48064, CVE-2022-48065.

Fixed

Changed error handling in get_metadata_value script to retry if connection error happens during instance metadata check.

Change

Updated latest GPU driver to v535.104.05.

Fixed

Fixed problem with NFS reconnects when using DPv2 in kube-proxy-free mode.

September 07, 2023

2023-09-07T00:00:00-07:00

Change

cos-97-16919-353-31

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.186	v20.10.24	v1.6.21	v470.199.02(default),v525.125.06

Security

Upgraded sys-process/procps to 3.3.17. This fixed CVE-2018-1121 and CVE-2023-4016.

Security

Upgraded sys-fs/mdadm to v4.2. This resolves CVE-2023-28938 and CVE-2023-28736.

Security

Fixed CVE-2023-4128 in the Linux kernel.

Fixed

Enabled persistence mode with Nvidia GPU driver installation.

Feature

Enabled trusted IMA certificate loading from /etc/ima/pubkey.x509.

Security

Updated xz-utils to 5.2.9. This resolves CVE-2020-22916.

Change

Runtime sysctl changes:

Added: kernel.io_uring_disabled: 0

August 21, 2023

2023-08-21T00:00:00-07:00

Change

cos-97-16919-353-23

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.186	v20.10.24	v1.6.21	v470.199.02(default),v525.125.06

Security

Fixed CVE-2023-4194 in the Linux kernel.

Security

Fixed CVE-2023-4147 in the Linux kernel.

Security

Upgrade app-misc/jq to v1.7_pre20201109-r1. This fixes CVE-2016-4074.

Change

Simplified GPU driver installation by remounting the driver installation path as executable from cos-extensions.

Security

Updated dev-libs/openssl to v1.1.1v. This resolves CVE-2023-3817.

August 14, 2023

2023-08-14T00:00:00-07:00

Change

cos-97-16919-353-15

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.186	v20.10.24	v1.6.21	v470.199.02(default),v525.125.06

Security

Fixed CVE-2023-32001 in net-misc/curl.

Security

Fixed CVE-2023-38408 in net-misc/openssh.

Security

Fixed CVE-2022-28737 in sys-boot/shim.

Security

Fixed CVE-2023-4004, CVE-2023-3777, CVE-2023-3776, CVE-2023-1206 and CVE-2023-3611 in the Linux kernel.

Security

Fixed CVE-2022-40896 in dev-python/pygments.

July 25, 2023

2023-07-25T00:00:00-07:00

Change

cos-97-16919-353-4

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.186	v20.10.24	v1.6.21	v470.199.02(default),v525.125.06

Security

Fixed CVE-2023-35001 in the Linux kernel.

Security

Fixed CVE-2023-31248 in the Linux kernel.

July 18, 2023

2023-07-18T00:00:00-07:00

Change

cos-97-16919-353-1

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.186	v20.10.24	v1.6.21	v470.199.02 (default),v525.125.06

Announcement

This is an LTS Refresh Release.

Change

Updated app-emulation/docker and app-emulation/docker-cli to v20.10.24.

Change

Updated app-admin/google-osconfig-agent to v20230222.00.

Security

Fixed CVE-2023-3609 in the Linux kernel.

Security

Updated default GPU driver to v470.199.02 and latest GPU driver to v525.125.06. This resolves CVE-2023-25515 and CVE-2023-25516.

Change

Updated containerd to v1.6.21

Security

Updated open-vm-tools to v12.2.5. This resolves CVE-2023-20867.

Change

Runtime sysctl changes:

Changed: net.core.bpf_jit_limit: 264241152 -> 528482304

July 13, 2023

2023-07-13T00:00:00-07:00

Change

cos-97-16919-294-51

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.176	v20.10.14	v1.6.20	v470.182.03(default),v525.105.17

Security

Fixed CVE-2023-31486 in perl.

Security

Fixed CVE-2023-3090 in the Linux kernel.

June 29, 2023

2023-06-29T00:00:00-07:00

Change

cos-97-16919-294-48

Kernel	Docker	Containerd	GPU Drivers
COS-5.10.176	v20.10.14	v1.6.20	v470.182.03(default),v525.105.17

Security

Fixed CVE-2023-3268 in the Linux kernel.

Security

Upgraded sys-apps/file to v5.43-r1 to fix CVE-2019-18218.