File and Directory Vulnerability in runc Container Runtime by OpenContainers

CVE-2024-45310

Summary

A vulnerability in runc allows an attacker to exploit a race condition when creating empty files or directories in arbitrary locations on the host filesystem by utilizing shared volumes between containers. This affects runc versions 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier. Although this vulnerability does not truncate existing files, it poses a risk if an attacker can start containers with custom volume configurations. The potential to create inodes is somewhat mitigated with user namespaces, limiting the locations to world-writable directories. Implementation of strict LSM policies like SELinux or AppArmor may also help restrict this vulnerability's impact, although their effectiveness varies and has not been exhaustively tested.

References