How can I upgrade to the new kernel in 1.22.3 without a factory reset? [macOS/Linux]

[jandubois]

Background

Rancher Desktop 1.22.3 ships with an updated kernel that no longer includes the modules vulnerable to the copy.fail and dirtyfrag exploits. These exploits would let a process running inside a container access and modify host files that have not been mounted into it.

On macOS and Linux, upgrading to 1.22.3 does not refresh the kernel automatically; to update it, you must either factory-reset Rancher Desktop (which wipes existing images and Kubernetes workloads) or follow the procedure below.

On Windows, the vulnerable modules are removed on every start of Rancher Desktop, so the update applies automatically and no factory reset is required.

Check if you are running the new kernel

You can verify that you don't have the affected kernel modules installed with

❯ rdctl shell modinfo algif_aead
modinfo: module '/lib/modules/6.6.137-0-virt/algif_aead' not found

However, if you get the following output, then you are still running the old version:

❯ rdctl shell modinfo algif_aead
filename:       /lib/modules/6.6.119-0-virt/kernel/crypto/algif_aead.ko
author:         Stephan Mueller <smueller@chronox.de>
description:    AEAD kernel crypto API user space interface
license:        GPL
depends:        af_alg
intree:         Y
vermagic:       6.6.119-0-virt SMP preempt mod_unload modversions aarch64

Workaround to force a kernel update

The following is a workaround to trigger the update without doing a factory reset:

1. Make sure you have installed 1.22.3.

2. Shut down Rancher Desktop

3. Edit the lima.yaml file. The path depends on the OS:

   Linux: ~/.local/share/rancher-desktop/lima/0/lima.yaml
   macOS: ~/Library/Application\ Support/rancher-desktop/lima/0/lima.yaml

   It will contain this block (example shows macOS path):

   images:
     - location: /Applications/Rancher Desktop.app/Contents/Resources/resources/darwin/alpine-lima-v0.2.47.rd1-rd-3.23.0.iso

   Edit the filename so the version segment reads v0.2.47.rd0-rd-3.23.0.iso. You may see either rd1 or rd1.2 between v0.2.47. and -rd-; replace whichever you find with rd0.

4. Restart Rancher Desktop

5. Verify that you are running the new kernel with the modinfo command shown above.

Note

Snapshots created with 1.22.0 still contain the vulnerable kernel, so restoring one will require upgrading the kernel again. Consider saving a fresh snapshot after the upgrade.

[joklek-vinted]

My lima.yaml file shows alpine-lima-v0.2.47.rd1.2-rd-3.23.0.iso, but rdctl shell modinfo algif_aead finds the affected module. What am I doing wrong?

[Mishco]

I have similar issue Rancher Desktop version 1.22.3 on Ubuntu 24.04. I have replaced location in lima.yaml with alpine-lima-v0.2.47.rd0-rd-3.23.0.iso but after restart it is replaced back:

$~ rdctl shell uname -a
Linux lima-rancher-desktop 6.6.137-0-virt
$~ less .local/share/rancher-desktop/lima/0/lima.yaml | grep location
  - location: /opt/rancher-desktop/resources/resources/linux/alpine-lima-v0.2.47.rd1.2-rd-3.23.0.iso
  - location: "~"
  - location: /tmp/rancher-desktop
  - location: /opt/rancher-desktop/resources/resources
$~

[jandubois]

That is expected, please check the output of rdctl shell modinfo algif_aead.

[Mishco]

➜  ~ rdctl shell modinfo algif_aead
modinfo: module '/lib/modules/6.6.137-0-virt/algif_aead' not found
➜  ~ 

[jandubois]

That (6.6.137 instead of 6.6.119) means you are running the updated kernel and the vulnerable module is not installed.

[Mishco]

Yes that is true, but I think it is mixed with different bug: Error Starting Rancher Desktop Error: /opt/rancher-desktop/resources/resources/linux/lima/bin/limactl exited with code 1 and

WARNING: Skipping duplicate certificate in file ca-cert-Certainly_Root_R1.pem
WARNING: Skipping duplicate certificate in file ca-cert-rd-139.pem
WARNING: Skipping duplicate certificate in file ca-cert-Atos_TrustedRoot_Root_CA_RSA_TLS_2021.pem
WARNING: Skipping duplicate certificate in file ca-cert-rd-140.pem
WARNING: Skipping duplicate certificate in file ca-cert-rd-79.pem
WARNING: Skipping duplicate certificate in file ca-cert-Certum_Trusted_Network_CA_2.pem
WARNING: Skipping duplicate certificate in file ca-cert-GLOBALTRUST_2020.pem
WARNING: Skipping duplicate certificate in file ca-cert-rd-106.pem

and I have tried to remove these files:

➜  ~ rm -rf ~/.lima               
➜  ~ rm -rf ~/.rd/ca-certificates/ 
➜  ~ rm -rf ~/.rd/lima  
➜  ~ nano  .local/share/rancher-desktop/lima/0/lima.yaml  # here I edit that location 
➜  ~ rdctl shell modinfo algif_aead
modinfo: module '/lib/modules/6.6.137-0-virt/algif_aead' not found
➜  ~ rancher-desktop    # and error during startup 

any idea how to fix that?