CVE-2021-30465
Vulnerability Summary
Timeline
Description
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
CVSS Metrics
- v3.1•HIGH•Score: 8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- v3.1•HIGH•Score: 7.6CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- v2.0•MEDIUM•Score: 6AV:N/AC:M/Au:S/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 6.60%• Percentile: 94%
Techniques & Countermeasures
- CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected Systems
- chainguard•runc
< 0
- chainguard•runc-doc
< 0
- wolfi•runc
< 0
- wolfi•runc-doc
< 0
- debian•runc
< 1.0.0~rc93+ds1-5 | < 1.0.0~rc93+ds1-5 | < 1.0.0~rc93+ds1-5 | < 1.0.0~rc93+ds1-5
- fedoraproject•fedora
33 | 34
- github.com/opencontainers•runc
< 1.0.0-rc95
- linuxfoundation•runc
≤ 0.1.1 | 1.0.0:rc1 | 1.0.0:rc10 | 1.0.0:rc2 | 1.0.0:rc3 | 1.0.0:rc4 | 1.0.0:rc5 | 1.0.0:rc6 | 1.0.0:rc7 | 1.0.0:rc8 | 1.0.0:rc9 | 1.0.0:rc90 | 1.0.0:rc91 | 1.0.0:rc92 | 1.0.0:rc93 | 1.0.0:rc94
- redhat•buildah
< 0:1.11.6-8.module+el8.4.0+10193+e90fd8eb | < 0:1.11.6-7.module+el8.2.0+11121+714aca16 | < 0:1.19.7-1.module+el8.4.0+11310+8c67a752 | < 0:1.19.7-2.module+el8.4.0+11311+9da8acfb
- redhat•buildah-debuginfo
< 0:1.11.6-8.module+el8.4.0+10193+e90fd8eb | < 0:1.11.6-7.module+el8.2.0+11121+714aca16 | < 0:1.19.7-1.module+el8.4.0+11310+8c67a752 | < 0:1.19.7-2.module+el8.4.0+11311+9da8acfb
- redhat•buildah-debugsource
< 0:1.11.6-8.module+el8.4.0+10193+e90fd8eb | < 0:1.11.6-7.module+el8.2.0+11121+714aca16 | < 0:1.19.7-1.module+el8.4.0+11310+8c67a752 | < 0:1.19.7-2.module+el8.4.0+11311+9da8acfb
- redhat•buildah-tests
< 0:1.11.6-8.module+el8.4.0+10193+e90fd8eb | < 0:1.11.6-7.module+el8.2.0+11121+714aca16 | < 0:1.19.7-1.module+el8.4.0+11310+8c67a752 | < 0:1.19.7-2.module+el8.4.0+11311+9da8acfb
- redhat•buildah-tests-debuginfo
< 0:1.11.6-8.module+el8.4.0+10193+e90fd8eb | < 0:1.11.6-7.module+el8.2.0+11121+714aca16 | < 0:1.19.7-1.module+el8.4.0+11310+8c67a752 | < 0:1.19.7-2.module+el8.4.0+11311+9da8acfb
- redhat•cockpit-podman
< 0:11-1.module+el8.4.0+10193+e90fd8eb | < 0:11-1.module+el8.2.0+11121+714aca16 | < 0:29-2.module+el8.4.0+11310+8c67a752 | < 0:29-2.module+el8.4.0+11311+9da8acfb
- redhat•conmon
< 2:2.0.15-1.module+el8.4.0+10193+e90fd8eb | < 2:2.0.6-1.module+el8.2.0+11121+714aca16 | < 2:2.0.26-1.module+el8.4.0+11310+8c67a752 | < 2:2.0.26-3.module+el8.4.0+11311+9da8acfb
- redhat•conmon-debuginfo
< 2:2.0.26-1.module+el8.4.0+11310+8c67a752 | < 2:2.0.26-3.module+el8.4.0+11311+9da8acfb
- redhat•conmon-debugsource
< 2:2.0.26-1.module+el8.4.0+11310+8c67a752 | < 2:2.0.26-3.module+el8.4.0+11311+9da8acfb
- redhat•container-selinux
< 2:2.130.0-1.module+el8.4.0+10193+e90fd8eb | < 2:2.124.0-1.module+el8.2.0+11121+714aca16 | < 2:2.158.0-1.module+el8.4.0+11310+8c67a752 | < 2:2.162.0-1.module+el8.4.0+11311+9da8acfb
- redhat•containernetworking-plugins
< 0:0.8.3-4.module+el8.4.0+10193+e90fd8eb | < 0:0.8.3-4.module+el8.2.0+11121+714aca16 | < 0:0.9.1-1.module+el8.4.0+11310+8c67a752 | < 0:0.9.1-1.module+el8.4.0+11311+9da8acfb
- redhat•containernetworking-plugins-debuginfo
< 0:0.8.3-4.module+el8.4.0+10193+e90fd8eb | < 0:0.8.3-4.module+el8.2.0+11121+714aca16 | < 0:0.9.1-1.module+el8.4.0+11310+8c67a752 | < 0:0.9.1-1.module+el8.4.0+11311+9da8acfb
- redhat•containernetworking-plugins-debugsource
< 0:0.8.3-4.module+el8.4.0+10193+e90fd8eb | < 0:0.8.3-4.module+el8.2.0+11121+714aca16 | < 0:0.9.1-1.module+el8.4.0+11310+8c67a752 | < 0:0.9.1-1.module+el8.4.0+11311+9da8acfb
- redhat•containers-common
< 1:0.1.41-4.module+el8.4.0+10193+e90fd8eb | < 1:0.1.40-9.module+el8.2.0+11121+714aca16 | < 1:1.2.2-7.module+el8.4.0+11310+8c67a752 | < 1:1.2.2-10.module+el8.4.0+11311+9da8acfb
- redhat•crit
< 0:3.12-9.module+el8.4.0+10193+e90fd8eb | < 0:3.12-9.module+el8.2.0+11121+714aca16 | < 0:3.15-1.module+el8.4.0+11310+8c67a752 | < 0:3.15-1.module+el8.4.0+11311+9da8acfb
- redhat•criu
< 0:3.12-9.module+el8.4.0+10193+e90fd8eb | < 0:3.12-9.module+el8.2.0+11121+714aca16 | < 0:3.15-1.module+el8.4.0+11310+8c67a752 | < 0:3.15-1.module+el8.4.0+11311+9da8acfb
- redhat•criu-debuginfo
< 0:3.12-9.module+el8.4.0+10193+e90fd8eb | < 0:3.12-9.module+el8.2.0+11121+714aca16 | < 0:3.15-1.module+el8.4.0+11310+8c67a752 | < 0:3.15-1.module+el8.4.0+11311+9da8acfb
- redhat•criu-debugsource
< 0:3.12-9.module+el8.4.0+10193+e90fd8eb | < 0:3.12-9.module+el8.2.0+11121+714aca16 | < 0:3.15-1.module+el8.4.0+11310+8c67a752 | < 0:3.15-1.module+el8.4.0+11311+9da8acfb
- redhat•crun
< 0:0.18-2.module+el8.4.0+11310+8c67a752 | < 0:0.18-2.module+el8.4.0+11311+9da8acfb
- redhat•crun-debuginfo
< 0:0.18-2.module+el8.4.0+11310+8c67a752 | < 0:0.18-2.module+el8.4.0+11311+9da8acfb
- redhat•crun-debugsource
< 0:0.18-2.module+el8.4.0+11310+8c67a752 | < 0:0.18-2.module+el8.4.0+11311+9da8acfb
- redhat•docker
< 2:1.13.1-206.git7d71120.el7_9
- redhat•docker-client
< 2:1.13.1-206.git7d71120.el7_9
- redhat•docker-common
< 2:1.13.1-206.git7d71120.el7_9
- redhat•docker-debuginfo
< 2:1.13.1-206.git7d71120.el7_9
- redhat•docker-logrotate
< 2:1.13.1-206.git7d71120.el7_9
- redhat•docker-lvm-plugin
< 2:1.13.1-206.git7d71120.el7_9
- redhat•docker-novolume-plugin
< 2:1.13.1-206.git7d71120.el7_9
- redhat•docker-rhel-push-plugin
< 2:1.13.1-206.git7d71120.el7_9
- redhat•docker-v1.10-migrator
< 2:1.13.1-206.git7d71120.el7_9
- redhat•fuse-overlayfs
< 0:0.7.8-1.module+el8.4.0+10193+e90fd8eb | < 0:0.7.2-5.module+el8.2.0+11121+714aca16 | < 0:1.4.0-2.module+el8.4.0+11310+8c67a752 | < 0:1.4.0-3.module+el8.4.0+11311+9da8acfb
- redhat•fuse-overlayfs-debuginfo
< 0:0.7.8-1.module+el8.4.0+10193+e90fd8eb | < 0:0.7.2-5.module+el8.2.0+11121+714aca16 | < 0:1.4.0-2.module+el8.4.0+11310+8c67a752 | < 0:1.4.0-3.module+el8.4.0+11311+9da8acfb
- redhat•fuse-overlayfs-debugsource
< 0:0.7.8-1.module+el8.4.0+10193+e90fd8eb | < 0:0.7.2-5.module+el8.2.0+11121+714aca16 | < 0:1.4.0-2.module+el8.4.0+11310+8c67a752 | < 0:1.4.0-3.module+el8.4.0+11311+9da8acfb
- redhat•libslirp
< 0:4.3.1-1.module+el8.4.0+11310+8c67a752 | < 0:4.3.1-1.module+el8.4.0+11311+9da8acfb
- redhat•libslirp-debuginfo
< 0:4.3.1-1.module+el8.4.0+11310+8c67a752 | < 0:4.3.1-1.module+el8.4.0+11311+9da8acfb
- redhat•libslirp-debugsource
< 0:4.3.1-1.module+el8.4.0+11310+8c67a752 | < 0:4.3.1-1.module+el8.4.0+11311+9da8acfb
- redhat•libslirp-devel
< 0:4.3.1-1.module+el8.4.0+11310+8c67a752 | < 0:4.3.1-1.module+el8.4.0+11311+9da8acfb
- redhat•oci-seccomp-bpf-hook
< 0:1.2.0-1.module+el8.4.0+11310+8c67a752 | < 0:1.2.0-2.module+el8.4.0+11311+9da8acfb
- redhat•oci-seccomp-bpf-hook-debuginfo
< 0:1.2.0-1.module+el8.4.0+11310+8c67a752 | < 0:1.2.0-2.module+el8.4.0+11311+9da8acfb
- redhat•oci-seccomp-bpf-hook-debugsource
< 0:1.2.0-1.module+el8.4.0+11310+8c67a752 | < 0:1.2.0-2.module+el8.4.0+11311+9da8acfb
- redhat•openshift
< 0:4.6.0-202105150940.p0.git.9caf8fe.el7 | < 0:4.6.0-202105150940.p0.git.9caf8fe.el8 | < 0:4.5.0-202105121820.p0.git.d8ef5ad.el7 | < 0:4.5.0-202105121820.p0.git.d8ef5ad.el8
- redhat•openshift-hyperkube
< 0:4.6.0-202105150940.p0.git.9caf8fe.el7 | < 0:4.6.0-202105150940.p0.git.9caf8fe.el8 | < 0:4.5.0-202105121820.p0.git.d8ef5ad.el7 | < 0:4.5.0-202105121820.p0.git.d8ef5ad.el8
Showing first 50 affected entries in server-rendered view.
References (47)
- https://github.com/opencontainers/runc/releases
- http://www.openwall.com/lists/oss-security/2021/05/19/2
- https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH/
- https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f
- https://bugzilla.opensuse.org/show_bug.cgi?id=1185405
- https://security.netapp.com/advisory/ntap-20210708-0003/
- https://security.gentoo.org/glsa/202107-26
- https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-30465
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV
- https://security.netapp.com/advisory/ntap-20210708-0003
- https://access.redhat.com/errata/RHSA-2021:1566
- https://access.redhat.com/security/updates/classification/#important
- https://access.redhat.com/security/vulnerabilities/RHSB-2021-004
- https://bugzilla.redhat.com/show_bug.cgi?id=1954736
- https://bugzilla.redhat.com/show_bug.cgi?id=1961019
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1566.json
- https://access.redhat.com/security/cve/CVE-2021-30465
- https://www.cve.org/CVERecord?id=CVE-2021-30465
- https://access.redhat.com/errata/RHSA-2021:2057
- https://bugzilla.redhat.com/show_bug.cgi?id=1962453
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2057.json
- https://access.redhat.com/errata/RHSA-2021:2144
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2144.json
- https://access.redhat.com/errata/RHSA-2021:2145
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2145.json
- https://access.redhat.com/errata/RHSA-2021:2150
- https://bugzilla.redhat.com/show_bug.cgi?id=1939605
- https://bugzilla.redhat.com/show_bug.cgi?id=1949123
- https://bugzilla.redhat.com/show_bug.cgi?id=1949153
- https://bugzilla.redhat.com/show_bug.cgi?id=1949519
- https://bugzilla.redhat.com/show_bug.cgi?id=1954353
- https://bugzilla.redhat.com/show_bug.cgi?id=1955012
- https://bugzilla.redhat.com/show_bug.cgi?id=1955024
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2150.json
- https://access.redhat.com/errata/RHSA-2021:2291
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2291.json
- https://access.redhat.com/errata/RHSA-2021:2292
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2292.json
- https://access.redhat.com/errata/RHSA-2021:2370
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2370.json
- https://access.redhat.com/errata/RHSA-2021:2371
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2371.json
- https://security-tracker.debian.org/tracker/CVE-2021-30465