Most recent entries from all

ALSA-2021:2291 — Important: container-tools:2.0 security update

Affected: AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu, AlmaLinux:8: fuse-overlayfs, AlmaLinux:8: python-podman-api, AlmaLinux:8: python3-criu and 5 more

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* runc: vulnerable to symlink exchange attack (CVE-2021-30465)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-03670

Withdrawn: BELL-CVE-2021-30465 — CVE-2021-30465 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2022-avi-591 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2022-avi-591

Withdrawn: CLEANSTART-2026-CN11164 — Security fixes in runc 1.0.0_rc95-r0

Withdrawn by the publisher.

Affected: CleanStart: runc

Package runc version 1.0.0_rc95-r0 fixes 1 vulnerabilities: CVE-2021-30465

EUVD-2026-26802

fkie_cve-2021-30465

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

GHSA-c3xm-pvg7-gh7r — mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs

Affected: Go: github.com/opencontainers/runc

### Summary

runc 1.0.0-rc94 and earlier are vulnerable to a symlink exchange attack whereby an attacker can request a seemingly-innocuous container configuration that actually results in the host filesystem being bind-mounted into the container (allowing for a container escape). CVE-2021-30465 has been assigned for this issue.

An attacker must have the ability to start containers using some kind of custom volume configuration, and while recommended container hardening mechanisms such as LSMs (AppArmor/SELinux) and user namespaces will restrict the amount of damage an attacker could do, they do not block this attack outright. We have a reproducer using Kubernetes (and the below description mentions Kubernetes-specific paths), but this is not a Kubernetes-specific issue.

The now-released [runc v1.0.0-rc95][release] contains a fix for this issue, we recommend users update as soon as possible.

[release]: https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95

### Details

In circumstances where a container is being started, and runc is mounting inside a volume shared with another container (which is conducting a symlink-exchange attack), runc can be tricked into mounting outside of the container rootfs by swapping the target of a mount with a symlink due to a time-of-check-to-time-of-use (TOCTTOU) flaw. This is fairly similar in style to previous TOCTTOU attacks (and is a problem we are working on solving with libpathrs).

However, this alone is not useful because t…

gsd-2021-30465

OESA-2021-1215 — runc security update

Affected: openEuler:20.03-LTS-SP1: runc

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fix(es): runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.(CVE-2021-30465)

openSUSE-SU-2021:1404-1 — Security update for containerd, docker, runc

Security update for containerd, docker, runc

RHSA-2021:1562 — Red Hat Security Advisory: OpenShift Container Platform 4.7.12 packages and security update

golang: crypto/elliptic: incorrect operations on the P-224 curve runc: vulnerable to symlink exchange attack

SUSE-SU-2021:3336-1 — Security update for containerd, docker, runc

Security update for containerd, docker, runc

UBUNTU-CVE-2021-30465

Affected: Ubuntu:Pro:16.04:LTS: runc, Ubuntu:18.04:LTS: runc, Ubuntu:20.04:LTS: runc

WID-SEC-W-2022-0510 — IBM DB2: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, willkürlichen Code mit erhöhten Rechten auszuführen, Informationen falsch darzustellen und beliebigen Code auszuführen.