{"id":"CVE-2021-30465","published":"2021-05-27T00:00:00Z","modified":"2024-08-03T22:32:40Z","title":"runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal","vendor":null,"product":null,"tier":"tail","description":{"text":"runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.10245,"percentile":0.95677,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/opencontainers/runc/releases","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2021/05/19/2","tags":["mailing-list"]},{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH/","tags":["vendor-advisory"]},{"url":"https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f","tags":[]},{"url":"https://bugzilla.opensuse.org/show_bug.cgi?id=1185405","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20210708-0003/","tags":[]},{"url":"https://security.gentoo.org/glsa/202107-26","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html","tags":["mailing-list"]}],"priority":{"score":19.1,"factors":[{"name":"EPSS percentile","points":19.14}]},"affected":[{"ecosystem":"Go","package":"github.com/opencontainers/runc","vulnerableRanges":["<1.0.0-rc95"],"patched":["1.0.0-rc95"],"from":["GHSA-c3xm-pvg7-gh7r","GO-2022-0914"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1034","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencontainers-runc-cve-2016-9962","parents":[{"from":"CVE-2019-19921","to":"CVE-2021-30465","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.0.0-rc9.0.20200122160610-2fc03cc11c77","toFixed":"1.0.0-rc95","daysApart":470},{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/2fc03cc11c775b7a8b2e48d7ee447cb9bef32ad0","https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f"],"basis":"shared function","functions":["mountToRootfs"]}]}],"children":[{"from":"CVE-2021-30465","to":"CVE-2021-43784","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.0.0-rc95","toFixed":"1.0.3","daysApart":193},{"kind":"same-code","provenance":"machine","files":["libcontainer/container_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f","https://github.com/opencontainers/runc/commit/9c444070ec7bb83995dbc0185da68284da71c554","https://github.com/opencontainers/runc/commit/d72d057ba794164c3cce9451a00b72a78b25e1ae"],"basis":"shared function","functions":["makeCriuRestoreMountpoints","mountCgroupV1","mountToRootfs","prepareBindMount","writeSystemProperty"]}]},{"from":"CVE-2021-30465","to":"CVE-2023-25809","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f","https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17"],"basis":"shared function","functions":["mountCgroupV2"]}]},{"from":"CVE-2021-30465","to":"CVE-2024-45310","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["libcontainer/container_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f","https://github.com/opencontainers/runc/commit/63c2908164f3a1daea455bf5bcd8d363d70328c7","https://github.com/opencontainers/runc/commit/8781993968fd964ac723ff5f360b6f259e809a3e"],"basis":"shared function","functions":["createDeviceNode","makeCriuRestoreMountpoints","mountCgroupV1","mountToRootfs"]}]},{"from":"CVE-2021-30465","to":"CVE-2025-52565","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f","https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4","https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398"],"basis":"shared function","functions":["createDeviceNode","createDevices"]}]}],"packageHistory":[{"cve":"CVE-2016-9962","published":"2017-01-31","fixed":"1.0.0-rc3","kev":false},{"cve":"CVE-2019-16884","published":"2019-09-25","fixed":"1.0.0-rc8.0.20190930145003-cad42f6e0932","kev":false},{"cve":"CVE-2019-19921","published":"2020-02-12","fixed":"1.0.0-rc9.0.20200122160610-2fc03cc11c77","kev":false},{"cve":"CVE-2021-30465","published":"2021-05-27","fixed":"1.0.0-rc95","kev":false},{"cve":"CVE-2021-43784","published":"2021-12-06","fixed":"1.1.0","kev":false},{"cve":"CVE-2022-29162","published":"2022-05-17","fixed":"1.1.2","kev":false},{"cve":"CVE-2023-25809","published":"2023-03-29","fixed":"1.1.5","kev":false}],"package":"Go:github.com/opencontainers/runc"}}