Affected: AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu, AlmaLinux:8: fuse-overlayfs, AlmaLinux:8: python-podman-api, AlmaLinux:8: python3-criu and 5 more

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* runc: vulnerable to symlink exchange attack (CVE-2021-30465)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Withdrawn by the publisher.

Withdrawn by the publisher.

Affected: CleanStart: runc

Package runc version 1.0.0_rc95-r0 fixes 1 vulnerabilities: CVE-2021-30465

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

Affected: Go: github.com/opencontainers/runc

### Summary

runc 1.0.0-rc94 and earlier are vulnerable to a symlink exchange attack whereby an attacker can request a seemingly-innocuous container configuration that actually results in the host filesystem being bind-mounted into the container (allowing for a container escape). CVE-2021-30465 has been assigned for this issue.

An attacker must have the ability to start containers using some kind of custom volume configuration, and while recommended container hardening mechanisms such as LSMs (AppArmor/SELinux) and user namespaces will restrict the amount of damage an attacker could do, they do not block this attack outright. We have a reproducer using Kubernetes (and the below description mentions Kubernetes-specific paths), but this is not a Kubernetes-specific issue.

The now-released [runc v1.0.0-rc95][release] contains a fix for this issue, we recommend users update as soon as possible.

[release]: https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95

### Details

In circumstances where a container is being started, and runc is mounting inside a volume shared with another container (which is conducting a symlink-exchange attack), runc can be tricked into mounting outside of the container rootfs by swapping the target of a mount with a symlink due to a time-of-check-to-time-of-use (TOCTTOU) flaw. This is fairly similar in style to previous TOCTTOU attacks (and is a problem we are working on solving with libpathrs).

However, this alone is not useful because t…

Affected: openEuler:20.03-LTS-SP1: runc

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fix(es): runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.(CVE-2021-30465)

Security update for containerd, docker, runc

golang: crypto/elliptic: incorrect operations on the P-224 curve runc: vulnerable to symlink exchange attack

Security update for containerd, docker, runc

Affected: Ubuntu:Pro:16.04:LTS: runc, Ubuntu:18.04:LTS: runc, Ubuntu:20.04:LTS: runc

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, willkürlichen Code mit erhöhten Rechten auszuführen, Informationen falsch darzustellen und beliebigen Code auszuführen.