Notice of runC Vulnerability That Allows a Container Filesystem Breakout via Directory Traversal (CVE-2021-30465)

Description

runC is vulnerable to a symlink exchange attack whereby an attacker can request a seemingly-innocuous pod configuration that actually results in the host filesystem being bind-mounted into the container (allowing for a container escape). CVE-2021-30465 has been assigned for this vulnerability. The details and POC of this vulnerability have been disclosed and the risk is high.

Impact

This vulnerability is present when the runC version is 1.0.0-rc94 or earlier. An attacker can create a malicious pod, mount the host directory to the container, and exploit a runC symlink and race condition vulnerability, allowing container escape and host filesystem access.

You need to check whether the runC version of a node is 1.0.0-rc94 or earlier to determine whether the node is affected by the vulnerability.

Solution

• Restrict untrusted users from creating workloads, especially configuring volume mounting parameters.
• Restrict the permissions of the container.
  • Use a non-root user.
  • Use capabilities to restrict the privileges of containers, such as CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, and CAP_SYS_ADMIN.
  • Use seccomp to restrict the attacker's system call permissions on the host kernel. For details, see Restrict a Container's Syscalls with Seccomp.

Helpful Links

https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r