Race condition in gVisor - #VU15669

Detailed vulnerability description

The vulnerability allows an adjacent attacker to overwrite arbitrary files on the host system.

The weakness exists due to race condition when the VFS layer in the sandboxed helper process attempts to ensure consistency between its dentry cache, the hostPaths in the unsandboxed helper, and the host filesystem. An adjacent attacker can desynchronize the dentry cache of the sandboxed helper such that two dentries refer to the same backing file and overwrite files in the host filesystem from inside a Docker container that uses gVisor's runsc".

Remediation

Sources

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1631
• https://github.com/google/gvisor/commit/75cd70ecc9abfd5daaefea04da5070a0e0d620dd