Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-30465

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

Published

2021-05-27T13:15:08.077

Last Modified

2024-11-21T06:03:58.593

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.5 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

6.8

Impact Score

6.4

Weaknesses

Type: Primary
CWE-362

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	linuxfoundation	runc	≤ 0.1.1	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Application	linuxfoundation	runc	1.0.0	Yes
Operating System	fedoraproject	fedora	33	Yes
Operating System	fedoraproject	fedora	34	Yes

References

http://www.openwall.com/lists/oss-security/2021/05/19/2 Mailing List, Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2021/05/19/2 Mailing List, Third Party Advisory ([email protected])
https://bugzilla.opensuse.org/show_bug.cgi?id=1185405 Issue Tracking ([email protected])
https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f Patch, Third Party Advisory ([email protected])
https://github.com/opencontainers/runc/releases Release Notes, Third Party Advisory ([email protected])
https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r Patch, Third Party Advisory ([email protected])
https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV/ ([email protected])
https://security.gentoo.org/glsa/202107-26 Third Party Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20210708-0003/ Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2021/05/19/2 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2021/05/19/2 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.opensuse.org/show_bug.cgi?id=1185405 Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/opencontainers/runc/releases Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV/ (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202107-26 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20210708-0003/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)