8.5
CVSSv3

CVE-2021-30465

Published: 27/05/2021 Updated: 07/11/2023
CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8
CVSS v3 Base Score: 8.5 | Impact Score: 6 | Exploitability Score: 1.8
VMScore: 536
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

Vulnerability Summary

runc prior to 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linuxfoundation runc 1.0.0

linuxfoundation runc

fedoraproject fedora 33

fedoraproject fedora 34

Vendor Advisories

Debian Bug report logs - #988768 runc: CVE-2021-30465 Package: runc; Maintainer for runc is Debian Go Packaging Team <team+pkg-go@trackerdebianorg>; Source for runc is src:runc (PTS, buildd, popcon) Reported by: Shengjing Zhu <zhsj@debianorg> Date: Wed, 19 May 2021 11:39:02 UTC Severity: serious Tags: help, secur ...
The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container The highest threat from this vulnerability is to data confidentiality and integrity as well as to system availability (CVE-2021-30465) ...
The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container The highest threat from this vulnerability is to data confidentiality and integrity as well as to system availability (CVE-2021-30465) ...
The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container The highest threat from this vulnerability is to data confidentiality and integrity as well as to system availability (CVE-2021-30465) ...
The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container The highest threat from this vulnerability is to data confidentiality and integrity as well as to system availability ...
runc 100-rc94 and earlier are vulnerable to a symlink exchange attack whereby an attacker can request a seemingly-innocuous container configuration that actually results in the host filesystem being bind-mounted into the container (allowing for a container escape) An attacker must have the ability to start containers using some kind of custom v ...

Github Repositories

云安全系列 收集与云安全相关的文章和工具 索引 文章 蓝队 工具 IAC扫描 IAC用例 基线扫描 合规 供应链安全 流量测防护 开源防护软件 公司 红队 工具 交流讨论 内容 文章 【云攻防系列】从攻击者视角聊聊K8S集群安全(上) K8s提权之RBAC权限滥用 云原生之Kubernetes安全

Updated for MacOs - Copied from https://github.com/kata-containers/kata-containers/tree/main/src/libs/safe-path

Safe Path A library to safely handle filesystem paths, typically for container runtimes There are often path related attacks, such as symlink based attacks, TOCTTOU attacks The safe-path crate provides several functions and utility structures to protect against path resolution related attacks Support Operating Systems: Linux Reference filepath-securejoin: secure_join() w

A fork of the rust safe_path crate that builds on Windows but exclude `pinned_path_buf` and `scoped_dir_builder`

Safe Path A library to safely handle filesystem paths, typically for container runtimes There are often path related attacks, such as symlink based attacks, TOCTTOU attacks The safe-path crate provides several functions and utility structures to protect against path resolution related attacks Support Operating Systems: Linux Reference filepath-securejoin: secure_join() w

Kubernetes hostPort allow services traffic interception when using kubeproxy IPVS (CVE-2019-9946) Host MITM attack via IPv6 rogue router advertisements (K8S / Docker / LXD / WSL2 / ) Bridge firewalling "bypass" using VLAN 0 Kubernetes MITM using LoadBalancer or ExternalIPs (CVE-2020-8554) Metadata service MITM allows root privilege escalation (EKS / GKE)

Safe Path A library to safely handle filesystem paths, typically for container runtimes There are often path related attacks, such as symlink based attacks, TOCTTOU attacks The safe-path crate provides several functions and utility structures to protect against path resolution related attacks Support Operating Systems: Linux Reference filepath-securejoin: secure_join() w

概览 产品简介 产品概念 使用须知 产品价格 名词解释 使用必读 入门必读 集群版本 维护说明 版本跟踪 126 版本说明 集群管理 创建集群 查看集群 删除集群 通过 Kubectl 管理集群 kubectl 命令行简介 安装及配置 kubectl 使用 web kubectl 集群更新凭证 创建 PVC 创建 Service StatefulSet 示例 ku

概览 产品简介 产品概念 使用须知 产品价格 名词解释 使用必读 入门必读 集群版本 维护说明 版本跟踪 126 版本说明 集群管理 创建集群 查看集群 删除集群 通过 Kubectl 管理集群 kubectl 命令行简介 安装及配置 kubectl 使用 web kubectl 集群更新凭证 创建 PVC 创建 Service StatefulSet 示例 ku