CVE-2021-30465

CWE-362 — Race ConditionCWE-22 — Path TraversalCWE-36711 documents7 sources
Severity
8.5HIGH
EPSS
2.4%
top 15.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Opencontainers/runcLinuxfoundation RuncFedoraproject Fedora
Timeline
PublishedMay 27
Latest updateAug 21

Description

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 1.8 | Impact: 6.0

Affected Packages4 packages

▶Debianrunc< 1.0.0~rc93+ds1-5+3
▶Ubunturunc< 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2

Also affects: Fedora 33, 34

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

6
OSV
Mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc↗2024-08-21
▶
OSV
runc vulnerabilities↗2021-08-10
▶
CVEList
CVE-2021-30465: runc before 1↗2021-05-27
▶
OSV
CVE-2021-30465: runc before 1↗2021-05-27
▶
OSV
mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs↗2021-05-25
▶

📋Vendor Advisories

4
Ubuntu
runC vulnerabilities↗2021-08-10
▶
Red Hat
runc: vulnerable to symlink exchange attack↗2021-05-19
▶
Ubuntu
runC vulnerability↗2021-05-19
▶
Debian
CVE-2021-30465: runc - runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Trav...↗2021
▶
CVE-2021-30465 (HIGH CVSS 8.5) | runc before 1.0.0-rc95 allows a Con | cvebase.io