CVE-2021-30465 mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs
Attackers can escape container isolation via a race condition in runc, enabling code execution and privilege escalation on the host.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-30465?
CVE-2021-30465 is a high-severity path traversal vulnerability in Fedoraproject Fedora, published on 27 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
Weakness: CWE-362
Which versions are affected by CVE-2021-30465?
3 open source packages ship an affected version, including github.com/opencontainers/runc. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/opencontainers/runc Go | All versions | 1.0.0-rc95 |
github.com/opencontainers/runc Go | All versions | 1.0.0-rc95 |
github.com/opencontainers/runc Go | All versions | 1.0.0-rc95 |
Linux distribution packages (37)
cockpit-podman AlmaLinux:8 | All versions | 11-1.module_el8.5.0+108+00865455 |
cockpit-podman AlmaLinux:8 | All versions | 11-1.module_el8.5.0+2635+e4386a39 |
cockpit-podman AlmaLinux:8 | All versions | 29-2.module_el8.6.0+2876+9ed4eae2 |
cockpit-podman AlmaLinux:8 | All versions | 29-2.module_el8.6.0+2876+9ed4eae2 |
conmon AlmaLinux:8 | All versions | 2:2.0.15-1.module_el8.5.0+108+00865455 |
conmon AlmaLinux:8 | All versions | 2:2.0.15-1.module_el8.5.0+2635+e4386a39 |
conmon AlmaLinux:8 | All versions | 2:2.0.26-1.module_el8.6.0+2876+9ed4eae2 |
conmon AlmaLinux:8 | All versions | 2:2.0.26-3.module_el8.7.0+3406+a17c4180 |
container-selinux AlmaLinux:8 | All versions | 2:2.130.0-1.module_el8.5.0+108+00865455 |
container-selinux AlmaLinux:8 | All versions | 2:2.130.0-1.module_el8.5.0+2635+e4386a39 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.8.3-4.module_el8.5.0+108+00865455 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.8.3-4.module_el8.5.0+2635+e4386a39 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.9.1-1.module_el8.6.0+2876+9ed4eae2 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.9.1-1.module_el8.6.0+2876+9ed4eae2 |
containers-common AlmaLinux:8 | All versions | 1:0.1.41-4.module_el8.5.0+108+00865455 |
containers-common AlmaLinux:8 | All versions | 1:0.1.41-4.module_el8.5.0+2635+e4386a39 |
crit AlmaLinux:8 | All versions | 3.12-9.module_el8.3.0+2044+12421f43 |
crit AlmaLinux:8 | All versions | 3.12-9.module_el8.4.0+2496+12421f43 |
crit AlmaLinux:8 | All versions | 3.12-9.module_el8.5.0+119+9a9ec082 |
crit AlmaLinux:8 | All versions | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
crit AlmaLinux:8 | All versions | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
criu AlmaLinux:8 | All versions | 3.12-9.module_el8.3.0+2044+12421f43 |
criu AlmaLinux:8 | All versions | 3.12-9.module_el8.4.0+2496+12421f43 |
criu AlmaLinux:8 | All versions | 3.12-9.module_el8.5.0+119+9a9ec082 |
criu AlmaLinux:8 | All versions | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
criu AlmaLinux:8 | All versions | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
fuse-overlayfs AlmaLinux:8 | All versions | 0.7.8-1.module_el8.5.0+108+00865455 |
fuse-overlayfs AlmaLinux:8 | All versions | 0.7.8-1.module_el8.5.0+2635+e4386a39 |
fuse-overlayfs AlmaLinux:8 | All versions | 1.4.0-2.module_el8.6.0+2876+9ed4eae2 |
libslirp AlmaLinux:8 | All versions | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
libslirp AlmaLinux:8 | All versions | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
libslirp-devel AlmaLinux:8 | All versions | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
libslirp-devel AlmaLinux:8 | All versions | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
python-podman-api AlmaLinux:8 | All versions | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455 |
python-podman-api AlmaLinux:8 | All versions | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39 |
python3-criu AlmaLinux:8 | All versions | 3.12-9.module_el8.3.0+2044+12421f43 |
python3-criu AlmaLinux:8 | All versions | 3.12-9.module_el8.4.0+2496+12421f43 |
Products include Fedoraproject Fedora, Linuxfoundation Runc.
How do I fix CVE-2021-30465?
Upgrade github.com/opencontainers/runc to 1.0.0-rc95 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-30465 being exploited?
There is no known exploitation of CVE-2021-30465 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALSA-2021:2291, ALSA-2021:2370, ALSA-2021:2371, AZL-44262, CLEANSTART-2026-EN07365, DEBIAN-CVE-2021-30465 and 19 more.