CVE-2021-30465

runc versiones anteriores a 1.0.0-rc95, permite un Container Filesystem Breakout por medio de un Salto de Directorio. Para explotar la vulnerabilidad, un atacante debe ser capaz de crear varios contenedores con una configuración de montaje bastante específica. El problema ocurre por medio de un ataque de intercambio de enlaces simbólicos que se basa en una condición de carrera

The runc package is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly innocuous container configuration that results in the host filesystem being bind-mounted into the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as to system availability.

An update that solves four vulnerabilities and has 13 fixes is now available. This update for containerd, docker, runc fixes the following issues. Docker was updated to 20.10.6-ce Switch version to use -ce suffix rather than _ce to avoid confusing other tools. Fixed a potential privilege escalation when the root user in the remapped namespace has access to the host filesystem. Fixed an issue where pulling a malformed Docker image manifest crashes the dockerd daemon. Btrfs quotas being removed by Docker regularly runc was updated to v1.0.0~rc93. Use the upstream runc package. Fixed /dev/null is not available. Fixed a symlink-exchange attack vulnarability. Containerd was updated to v1.4.4. Fixed a potential information leak through environment variables. Handle a requirement from docker. This update was imported from the SUSE:SLE-15:Update update project.