runc Race Condition Vulnerability (GHSA-jfvp-7x6p-h2pv) Creates Empty Host Files

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: runc can be tricked into creating empty files/directories on the host - Publisher: cyphar - Publication Time: 2 days ago - Vulnerability ID: GHSA-jfvp-7x6p-h2pv - CVSS Score: 3.6/10 (Low severity) 2. Affected Versions: - Affected Versions: <=1.1.13, <=1.2.0-rc.2 - Fixed Versions: 1.1.14, 1.2.0-rc.3 3. Description: - runc versions 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be exploited to create empty files or directories anywhere on the host filesystem via shared volumes, exploiting a race condition in the function. While this allows creation of empty files, existing files will not be truncated. - Attackers must be able to start containers using some custom volume configuration. Containers using user namespaces are still affected, but the number of inodes an attacker can create is significantly reduced. - Strict security labeling models (SELinux/AppArmor) can prevent this attack, but standard SELinux policies may limit the attack surface—though the exact scope has not been analyzed. 4. Workarounds: - Using user namespaces can significantly limit the attack, restricting attackers to creating inodes only in directories where the root user/group has write access. - When the root user is mapped to an actual user (e.g., in unprivileged containers not using ), attackers can only create inodes in world-writable directories. 5. Patches: - Fixed in runc v1.1.14 and v1.2.0-rc3. - Main patches: - #4359 - 63c2908 - Patch for release 1.1: - 8781993 - f0b652e 6. Contributors: - Rodrigo Campos Catelin (@rata) and Alban Crequy (@alban) from Microsoft discovered and reported this vulnerability. This information provides a detailed description of the vulnerability, affected versions, workarounds, and patch details, aiding in understanding the nature and remediation of the issue.

Goal Reached Thanks to every supporter — we hit 100%!

runc Race Condition Vulnerability (GHSA-jfvp-7x6p-h2pv) Creates Empty Host Files

More from this source