The Open Containers Initiative community has reported a vulnerability that is related to runC. An attacker can use a symlink and exploit race condition flaws to mount the host file system to a container by creating a malicious pod. This results in a container escape. This topic describes CVE-2021-30465 and the affected versions, impacts, and fixes of the vulnerability.
Description
In a Kubernetes cluster, an attacker can specify a mount target as a symlink in a volume that is mounted to the root directory of the host. For example, /var/lib/kubelet/pods/$MY_POD_UID/volumes/kubernetes.io~empty-dir specifies the symlink of an emptyDir volume. This way, the attacker can obtain a mount target from the host. The mount source is a directory that is controlled by the attacker. Therefore, the attacker can use a symlink to link the subdirectories from the mount source to the root directory of the host. Then, the attacker can exploit a Time Of Check To Time Of Use (TOCTTOU) flaw to mount a specified directory of the malicious container to the root directory of the host.
The severity of CVE-2021-30465 is rated high and the Common Vulnerability Scoring System (CVSS) score of the vulnerability is 7.6. For more information, see Official announcements.
Impacts
When multiple containers are started in a pod, an attacker can exploit a race condition
and create a malicious pod that contains a mount target with a symlink. Under certain
circumstances, the attacker can escape a container and access the host file system
except for the container rootfs.
Affected versions
runC 1.0.0-rc94 and earlier versions are affected by this vulnerability.
The vulnerability is fixed in runC 1.0.0-rc95. For more information, see runC 1.0.0-rc95.
Fixes
Manually upgrade containerd to the latest version. For information about the latest containerd version, see runC 1.0.0-rc95.