Container Filesystem Breakout Vulnerability in runc by OpenContainers

CVE-2021-30465

Summary

The vulnerability in runc allows an attacker to exploit container configurations that incorporate symlink-exchange attacks via a race condition. By creating multiple containers with specific mount settings, the attacker can manipulate the container’s file system. This can lead to the unintentional exposure of sensitive data or unauthorized access to the host file system. Effective mitigation strategies are essential to safeguard against such vulnerabilities.

References