runc container escape via "masked path" abuse due to mount race conditions
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.2.8, 1.3.3, 1.4.0-rc.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 3 proofs of concept on GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- opencontainers runc
fixed in 1.2.8; From 1.3.0-rc.1 · fixed in 1.3.3; From 1.4.0-rc.1 · through 1.4.0-rc.3
- github.com/opencontainers/runcGo
fixed in 1.2.8; From 1.3.0-rc.1 · fixed in 1.3.3; From 1.4.0-rc.1 · fixed in 1.4.0-rc.3
- github.com/opencontainers/runcGo
fixed in 1.2.8
- github.com/opencontainers/runcGo
From 1.3.0-rc.1 · fixed in 1.3.3
- github.com/opencontainers/runcGo
From 1.4.0-rc.1 · fixed in 1.4.0-rc.3