This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-30465 →

DEBIAN-CVE-2021-30465

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to creat...

Original description

The description as published by the source.

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 runc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93+ds1-5"}]}]

Debian:13 runc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93+ds1-5"}]}]

Debian:14 runc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93+ds1-5"}]}]

References

advisory security-tracker.debian.org