Veracode Vulnerability DatabaseVERACODE:30535Symlink Attack
8.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
github.com/opencontainers/runc is vulnerable to symlink attack. An attacker, with the ability to start containers using some kind of custom volume configuration, can request a seemingly-innocuous container configuration that results in the host file system being bind-mounted into the container, resulting in a container escape.
References
www.openwall.com/lists/oss-security/2021/05/19/2
bugzilla.opensuse.org/show_bug.cgi?id=1185405
github.com/containerd/containerd/pull/5514
github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f
github.com/opencontainers/runc/releases
github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r
lists.fedoraproject.org/archives/list/[email protected]/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH/
lists.fedoraproject.org/archives/list/[email protected]/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV/
security.gentoo.org/glsa/202107-26
security.netapp.com/advisory/ntap-20210708-0003/
Related
8.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P