Vulnerability-Lookup

MSRC_CVE-2024-45310

Vulnerability from csaf_microsoft - Published: 2024-09-01 07:00 - Updated: 2026-03-03 14:46

Summary

runc can be confused to create empty files/directories on the host

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2024-45310

3.6 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

CWE-363 - Race Condition Enabling Link Following

Affected products

Fixed 3 products

Product	Identifier	Version	Remediation
Unresolved product id: 17640-17084		—
Unresolved product id: 19725-17084		—
Unresolved product id: 19772-17086		—

Known affected 3 products

Product	Version	Remediation
Unresolved product id: 17084-22	—	Vendor Fix fix
Unresolved product id: 17084-13	—	Vendor Fix fix
Unresolved product id: 17086-9	—	Vendor Fix fix

Known not affected 14 products

Product	Identifier	Version	Remediation
Unresolved product id: 17084-18		—
Unresolved product id: 17084-14		—
Unresolved product id: 17084-12		—
Unresolved product id: 17084-20		—
Unresolved product id: 17086-11		—
Unresolved product id: 17086-8		—
Unresolved product id: 17086-7		—
Unresolved product id: 17086-6		—
Unresolved product id: 17084-15		—
Unresolved product id: 17084-21		—
Unresolved product id: 17084-19		—
Unresolved product id: 17086-16		—
Unresolved product id: 17086-17		—
Unresolved product id: 17086-5		—

Under investigation 5 products

Product	Identifier	Version	Remediation
Unresolved product id: 17086-4		—
Unresolved product id: 17086-2		—
Unresolved product id: 17086-1		—
Unresolved product id: 17086-10		—
Unresolved product id: 17086-3		—

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2024/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2024/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-45310 runc can be confused to create empty files/directories on the host - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-45310.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "runc can be confused to create empty files/directories on the host",
    "tracking": {
      "current_release_date": "2026-03-03T14:46:43.000Z",
      "generator": {
        "date": "2026-07-13T09:33:57.890Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-45310",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-01-10T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2025-02-11T00:00:00.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2025-04-05T00:00:00.000Z",
          "legacy_version": "3",
          "number": "3",
          "summary": "Information published."
        },
        {
          "date": "2025-08-06T00:00:00.000Z",
          "legacy_version": "4",
          "number": "4",
          "summary": "Added kata-containers to Azure Linux 3.0\nAdded cri-tools to Azure Linux 3.0\nAdded runc to Azure Linux 3.0\nAdded moby-runc to CBL-Mariner 2.0"
        },
        {
          "date": "2026-01-03T01:35:10.000Z",
          "legacy_version": "5",
          "number": "5",
          "summary": "Information published."
        },
        {
          "date": "2026-02-18T01:08:42.000Z",
          "legacy_version": "5.1",
          "number": "6",
          "summary": "Information published."
        },
        {
          "date": "2026-02-20T23:29:51.000Z",
          "legacy_version": "6",
          "number": "7",
          "summary": "Information published."
        },
        {
          "date": "2026-03-03T14:46:43.000Z",
          "legacy_version": "7",
          "number": "8",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "8"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              },
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 runc 0:1.2.2-1.azl3",
                "product": {
                  "name": "\u003cazl3 runc 0:1.2.2-1.azl3",
                  "product_id": "22"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 runc 0:1.2.2-1.azl3",
                "product": {
                  "name": "azl3 runc 0:1.2.2-1.azl3",
                  "product_id": "17640"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 runc 0:1.1.12-2.azl3",
                "product": {
                  "name": "\u003cazl3 runc 0:1.1.12-2.azl3",
                  "product_id": "13"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 runc 0:1.1.12-2.azl3",
                "product": {
                  "name": "azl3 runc 0:1.1.12-2.azl3",
                  "product_id": "19725"
                }
              }
            ],
            "category": "product_name",
            "name": "runc"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 moby-runc 0:1.1.9-8.cbl2",
                "product": {
                  "name": "\u003ccbl2 moby-runc 0:1.1.9-8.cbl2",
                  "product_id": "9"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 moby-runc 0:1.1.9-8.cbl2",
                "product": {
                  "name": "cbl2 moby-runc 0:1.1.9-8.cbl2",
                  "product_id": "19772"
                }
              }
            ],
            "category": "product_name",
            "name": "moby-runc"
          },
          {
            "category": "product_name",
            "name": "azl3 kubernetes 0:1.30.10-7.azl3",
            "product": {
              "name": "azl3 kubernetes 0:1.30.10-7.azl3",
              "product_id": "18"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 kata-containers-cc 0:3.15.0.aks0-1.azl3",
            "product": {
              "name": "azl3 kata-containers-cc 0:3.15.0.aks0-1.azl3",
              "product_id": "14"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 moby-engine 0:25.0.3-13.azl3",
            "product": {
              "name": "azl3 moby-engine 0:25.0.3-13.azl3",
              "product_id": "12"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 cri-tools 0:1.30.1-1.azl3",
            "product": {
              "name": "azl3 cri-tools 0:1.30.1-1.azl3",
              "product_id": "20"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 cri-tools 0:1.29.0-6.cbl2",
            "product": {
              "name": "cbl2 cri-tools 0:1.29.0-6.cbl2",
              "product_id": "11"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 cri-o 0:1.22.3-14.cbl2",
            "product": {
              "name": "cbl2 cri-o 0:1.22.3-14.cbl2",
              "product_id": "8"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 kubevirt 0:0.59.0-28.cbl2",
            "product": {
              "name": "cbl2 kubevirt 0:0.59.0-28.cbl2",
              "product_id": "7"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 moby-engine 0:24.0.9-17.cbl2",
            "product": {
              "name": "cbl2 moby-engine 0:24.0.9-17.cbl2",
              "product_id": "6"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 kata-containers 0:3.15.0.aks0-1.azl3",
            "product": {
              "name": "azl3 kata-containers 0:3.15.0.aks0-1.azl3",
              "product_id": "15"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 libcontainers-common 0:20240213-3.azl3",
            "product": {
              "name": "azl3 libcontainers-common 0:20240213-3.azl3",
              "product_id": "21"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 kubevirt 0:1.2.0-17.azl3",
            "product": {
              "name": "azl3 kubevirt 0:1.2.0-17.azl3",
              "product_id": "19"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 kata-containers-cc 0:3.2.0.azl2-6.cbl2",
            "product": {
              "name": "cbl2 kata-containers-cc 0:3.2.0.azl2-6.cbl2",
              "product_id": "16"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 kata-containers 0:3.2.0.azl2-6.cbl2",
            "product": {
              "name": "cbl2 kata-containers 0:3.2.0.azl2-6.cbl2",
              "product_id": "17"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 libcontainers-common 0:20210626-7.cbl2",
            "product": {
              "name": "cbl2 libcontainers-common 0:20210626-7.cbl2",
              "product_id": "5"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 runc 0:1.2.2-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-22"
        },
        "product_reference": "22",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 runc 0:1.2.2-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17640-17084"
        },
        "product_reference": "17640",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kubernetes 0:1.30.10-7.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-18"
        },
        "product_reference": "18",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kata-containers-cc 0:3.15.0.aks0-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-14"
        },
        "product_reference": "14",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 runc 0:1.1.12-2.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-13"
        },
        "product_reference": "13",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 runc 0:1.1.12-2.azl3 as a component of Azure Linux 3.0",
          "product_id": "19725-17084"
        },
        "product_reference": "19725",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 moby-engine 0:25.0.3-13.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-12"
        },
        "product_reference": "12",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 cri-tools 0:1.30.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-20"
        },
        "product_reference": "20",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 cri-tools 0:1.29.0-6.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-11"
        },
        "product_reference": "11",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 cri-o 0:1.22.3-14.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-8"
        },
        "product_reference": "8",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 kubevirt 0:0.59.0-28.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-7"
        },
        "product_reference": "7",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 moby-engine 0:24.0.9-17.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-6"
        },
        "product_reference": "6",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kata-containers 0:3.15.0.aks0-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-15"
        },
        "product_reference": "15",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 libcontainers-common 0:20240213-3.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-21"
        },
        "product_reference": "21",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kubevirt 0:1.2.0-17.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-19"
        },
        "product_reference": "19",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 kata-containers-cc 0:3.2.0.azl2-6.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-16"
        },
        "product_reference": "16",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 kata-containers 0:3.2.0.azl2-6.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-17"
        },
        "product_reference": "17",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 moby-runc 0:1.1.9-8.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-9"
        },
        "product_reference": "9",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 moby-runc 0:1.1.9-8.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "19772-17086"
        },
        "product_reference": "19772",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 libcontainers-common 0:20210626-7.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "17086"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45310",
      "cwe": {
        "id": "CWE-363",
        "name": "Race Condition Enabling Link Following"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17084-18",
            "17084-14",
            "17084-12",
            "17084-20",
            "17086-11",
            "17086-8",
            "17086-7",
            "17086-6",
            "17084-15",
            "17084-19",
            "17086-16",
            "17086-17"
          ]
        },
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "17084-21",
            "17086-5"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "17640-17084",
          "19725-17084",
          "19772-17086"
        ],
        "known_affected": [
          "17084-22",
          "17084-13",
          "17086-9"
        ],
        "known_not_affected": [
          "17084-18",
          "17084-14",
          "17084-12",
          "17084-20",
          "17086-11",
          "17086-8",
          "17086-7",
          "17086-6",
          "17084-15",
          "17084-21",
          "17084-19",
          "17086-16",
          "17086-17",
          "17086-5"
        ],
        "under_investigation": [
          "17086-4",
          "17086-2",
          "17086-1",
          "17086-10",
          "17086-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-45310 runc can be confused to create empty files/directories on the host - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-45310.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-10T00:00:00.000Z",
          "details": "0:1.2.2-1.azl3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-22",
            "17084-13"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2025-01-10T00:00:00.000Z",
          "details": "0:1.1.9-8.cbl2:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-9"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "environmentalsScore": 0.0,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 3.6,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "17084-22",
            "17084-13",
            "17086-9"
          ]
        }
      ],
      "title": "runc can be confused to create empty files/directories on the host"
    }
  ]
}

CVE-2024-45310 (GCVE-0-2024-45310)

Vulnerability from cvelistv5 – Published: 2024-09-03 19:07 – Updated: 2025-02-21 18:03

Title

runc can be confused to create empty files/directories on the host

Summary

runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3. Some workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual user on the host (such as with rootless containers that don't use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested.

Severity

3.6 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 20:03 UTC

CWE

CWE-363 - Race Condition Enabling Link Following
CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

GitHub_M mitre root Scorecard

References

7 references

URL	Tags
https://github.com/opencontainers/runc/security/a…	x_refsource_CONFIRM
https://github.com/opencontainers/runc/pull/4359	x_refsource_MISC
https://github.com/opencontainers/runc/commit/63c…	x_refsource_MISC
https://github.com/opencontainers/runc/commit/878…	x_refsource_MISC
https://github.com/opencontainers/runc/commit/f0b…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2024/09/03/1
https://security.netapp.com/advisory/ntap-2025022…

Impacted products

1 product

Vendor	Product	Version
opencontainers	runc	Affected: < 1.1.14 Affected: >= 1.2.0-rc-1, < 1.2.0-rc.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-21T18:03:30.271Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/09/03/1"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250221-0008/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45310",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T20:03:49.189600Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T20:03:57.256Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "runc",
          "vendor": "opencontainers",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.2.0-rc-1, \u003c 1.2.0-rc.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack\u0027s scope but the exact scope of protection hasn\u0027t been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3.\n\nSome workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual\nuser on the host (such as with rootless containers that don\u0027t use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-363",
              "description": "CWE-363: Race Condition Enabling Link Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-03T19:07:34.060Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/opencontainers/runc/security/advisories/GHSA-jfvp-7x6p-h2pv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencontainers/runc/security/advisories/GHSA-jfvp-7x6p-h2pv"
        },
        {
          "name": "https://github.com/opencontainers/runc/pull/4359",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencontainers/runc/pull/4359"
        },
        {
          "name": "https://github.com/opencontainers/runc/commit/63c2908164f3a1daea455bf5bcd8d363d70328c7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencontainers/runc/commit/63c2908164f3a1daea455bf5bcd8d363d70328c7"
        },
        {
          "name": "https://github.com/opencontainers/runc/commit/8781993968fd964ac723ff5f360b6f259e809a3e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencontainers/runc/commit/8781993968fd964ac723ff5f360b6f259e809a3e"
        },
        {
          "name": "https://github.com/opencontainers/runc/commit/f0b652ea61ff6750a8fcc69865d45a7abf37accf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencontainers/runc/commit/f0b652ea61ff6750a8fcc69865d45a7abf37accf"
        }
      ],
      "source": {
        "advisory": "GHSA-jfvp-7x6p-h2pv",
        "discovery": "UNKNOWN"
      },
      "title": "runc can be confused to create empty files/directories on the host"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-45310",
    "datePublished": "2024-09-03T19:07:34.060Z",
    "dateReserved": "2024-08-26T18:25:35.444Z",
    "dateUpdated": "2025-02-21T18:03:30.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

MSRC_CVE-2024-45310

CVE-2024-45310 (GCVE-0-2024-45310)

Tags

Sightings

Nomenclature

Related by attack behaviour