runc: vulnerable to symlink exchange attack

The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container. The highest threat from this vulnerability is to data confidentiality and integrity ...

runc: vulnerable to symlink exchange attack

The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container. The highest threat from this vulnerability is to data confidentiality and integrity ...

GHSA-C3XM-PVG7-GH7R mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs

Summary runc 1.0.0-rc94 and earlier are vulnerable to a symlink exchange attack whereby an attacker can request a seemingly-innocuous container configuration that actually results in the host filesystem being bind-mounted into the container allowing for a container escape. CVE-2021-30465 has been...

[ASA-202105-17] runc: sandbox escape

Arch Linux Security Advisory ASA-202105-17 ========================================== Severity: High Date : 2021-05-25 CVE-ID : CVE-2021-30465 Package : runc Type : sandbox escape Remote : No Link : https://security.archlinux.org/AVG-1972 Summary ======= The package runc before version 1.0.0rc95-...

runc: vulnerable to symlink exchange attack

The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container. The highest threat from this vulnerability is to data confidentiality and integrity ...

GHSA-7GCP-W6WW-2XV9 Path traversal and files overwrite with unsquashfs in singularity

Impact Due to insecure handling of path traversal and the lack of path sanitization within unsquashfs a distribution provided utility used by Singularity, it is possible to overwrite/create any files on the host filesystem during the extraction of a crafted squashfs filesystem. Squashfs extractio...

USN-4960-1 runc vulnerability

Etienne Champetier discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount the host filesystem into the container and escalate privileges...

runc 竞争条件问题漏洞

runc is a CLI Command Line Interface tool for generating and running containers according to the OCI specification. runc suffers from a Contested Condition Issue vulnerability that can be exploited by an attacker to bind a host filesystem to a container...

Docker path traversal vulnerability

Docker is an open source application container engine from the American company Docker. It supports creating a container lightweight virtual machine and deploying and running applications on Linux systems, as well as automating the installation, deployment and upgrade of applications through...

Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork (important)

openSUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork Announcement ID: openSUSE-SU-2021:0278-1 Rating: important References: 1174075 1176708 1178801 1178969 1180243 1180401 1181730 1181732 Cross-References: CVE-2020-15257 CVE-2021-21284...

Privilege Escalation

docker is vulnerable to privilege escalation. The --userns-remap option allows the root user in the remapped namespace, who has access to the host filesystem, to modify files under /var/lib/docker/ and write files with extended privileges...

CVE-2021-21284

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can...

UBUNTU-CVE-2021-21284

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can...

CVE-2021-21284

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can...

Docker 路径遍历漏洞

Docker is an open source application container engine from the American company Docker. It supports creating a container lightweight virtual machine and deploying and running applications on Linux systems, as well as automating the installation, deployment and upgrade of applications through...

Buffer overflow

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloade...

Deislabs Oras Backlink Vulnerability

Deislabs Oras is a Go-based software from the Deislabs team for pushing OCI packages to the registered end. Deislabs Oras suffers from a backlink vulnerability that can be exploited by an attacker to write or overwrite specific files on a host file system other than the user's...

Directory Traversal

github.com/kubernetes-sigs/secrets-store-csi-driver is vulnerable to directory traversal. An attacker can gain access to host filesystem including paths under var/lib/kubelet/pods that contain other Kubernetes Secrets...

CVE-2020-8568

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that...

CVE-2020-8568

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that...