Security features bypass in runc - CVE-2021-30465

Vulnerability identifier: #VU53399

CSH Severity: Low

CVSS v4 BT: 4.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-30465

CWE-ID: CWE-254

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the security features bypass issue. A remote authenticated attacker on the local network can perform a symlink exchange attack and host filesystem being bind-mounted into the container.

runc
Gentoo Linux
Amazon Linux AMI
Arch Linux
SUSE Manager Server
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE MicroOS
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
SUSE Linux Enterprise Module for Containers
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
Ubuntu
openEuler
Fedora
runc (Red Hat package)
docker (Red Hat package)
jenkins (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
openshift (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
toolbox
skopeo-tests
skopeo
containers-common
udica
slirp4netns
fuse-overlayfs
containernetworking-plugins
crun
docker-runc
runc (Ubuntu package)
runc
runc-debuginfo
python-podman-api
oci-seccomp-bpf-hook
containerd
podman-docker
podman-tests
podman-remote
podman
buildah-tests
buildah
conmon
container-selinux
podman-catatonit
podman-plugins
crit
python3-criu
criu
libslirp
libslirp-devel
cockpit-podman
containerd
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Storage Ceph
IBM supplied MQ Advanced container images
Robotic Process Automation for Cloud Pak
QRadar Suite
Red Hat OpenShift Container Platform
IBM Edge Application Manager
IBM MQ Operator
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
Dell EMC VxRail Appliance

Install updates from vendor's website.

runc - update to 1.0.0 rc95
runc (Red Hat package) - addressed in versions 1.0.0-69.rc10.el7_9, 1.0.0-74.rhaos4.5.gitd2c3b70.el7, 1.0.0-74.rhaos4.5.gitd2c3b70.el8, 1.0.0-87.rhaos4.6.git23384e2.el7, 1.0.0-87.rhaos4.6.git23384e2.el8, 1.0.0-96.rhaos4.8.gitcd80260.el7, 1.0.0-96.rhaos4.8.gitcd80260.el8
containerd - addressed in versions 1.4.6, 1.5.2
QRadar Suite - update to 1.10.21.0
docker (Red Hat package) - update to 1.13.1-206.git7d71120.el7_9
jenkins (Red Hat package) - update to 2.277.3.1620985335-1.el8
Red Hat OpenShift Container Platform - addressed in versions 3.11.452, 4.5.40, 4.6.30, 4.7.12
atomic-openshift (Red Hat package) - update to 3.11.452-1.git.0.a782948.el7
openshift-ansible (Red Hat package) - update to 3.11.452-1.git.0.304c046.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.452-1.git.99b2acf.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.452-1.git.13de638.el7
atomic-openshift-service-idler (Red Hat package) - update to 3.11.452-1.git.39cfc66.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.452-1.git.f8bf728.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.452-1.git.c8f26da.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.452-1.git.f2f435d.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.452-1.git.84ed3f6.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.452-1.git.d435537.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.452-1.git.22be164.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.452-1.git.edebe84.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.452-1.git.609cd20.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.452-1.git.2e6be86.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.452-1.git.99aae51.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.452-1.git.3571208.el7
openshift-kuryr (Red Hat package) - addressed in versions 3.11.452-1.git.c33a657.el7, 4.7.0-202105140104.p0.git.8b61936.el8
openshift (Red Hat package) - addressed in versions 4.5.0-202105121820.p0.git.d8ef5ad.el7, 4.5.0-202105121820.p0.git.d8ef5ad.el8, 4.6.0-202105150940.p0.git.9caf8fe.el7, 4.6.0-202105150940.p0.git.9caf8fe.el8, 4.7.0-202105160013.p0.git.df9c838.el7, 4.7.0-202105160013.p0.git.df9c838.el8
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
toolbox - addressed in versions 0.0.7-1, 0.0.8-1
skopeo-tests - addressed in versions 0.1.40-9, 0.1.41-4, 1.2.2-7, 1.2.2-10
skopeo - addressed in versions 0.1.40-9, 0.1.41-4, 1.2.2-7, 1.2.2-10
containers-common - addressed in versions 0.1.40-9, 0.1.41-4, 1.2.2-7, 1.2.2-10
udica - addressed in versions 0.2.1-2, 0.2.4-1
slirp4netns - addressed in versions 0.4.2-3.git21fdece, 1.1.8-1
fuse-overlayfs - addressed in versions 0.7.2-5, 0.7.8-1, 1.4.0-2, 1.4.0-3
containernetworking-plugins - addressed in versions 0.8.3-4, 0.9.1-1
crun - update to 0.18-2
docker-runc - update to 1.0.0 rc3-201
runc (Ubuntu package) - addressed in versions 1.0.0~rc93-0ubuntu1.1, 1.0.0~rc93-0ubuntu1~18.04.2, 1.0.0~rc93-0ubuntu1~20.04.2, 1.0.0~rc93-0ubuntu1~20.10.2
runc - addressed in versions 1.0.0~rc93-16.11.1, 1.0.2-16.14.1, 1.0.2-23.1
runc-debuginfo - addressed in versions 1.0.0~rc93-16.11.1, 1.0.2-16.14.1, 1.0.2-23.1
runc - addressed in versions 1.0.0-65.rc10, 1.0.0-71.rc92, 1.0.0-73.rc93
runc - addressed in versions 1.0.0-378.rc95.fc33, 1.0.0-378.rc95.fc34
python-podman-api - update to 1.2.0-0.2.gitd0a45fe
oci-seccomp-bpf-hook - addressed in versions 1.2.0-1, 1.2.0-2
containerd - addressed in versions 1.4.4-5.32.1, 1.4.11-16.45.1, 1.4.11-56.1
podman-docker - addressed in versions 1.6.4-19, 1.6.4-26, 3.0.1-6, 3.0.1-7
podman-tests - addressed in versions 1.6.4-19, 1.6.4-26, 3.0.1-6, 3.0.1-7
podman-remote - addressed in versions 1.6.4-19, 1.6.4-26, 3.0.1-6, 3.0.1-7
podman - addressed in versions 1.6.4-19, 1.6.4-26, 3.0.1-6, 3.0.1-7
buildah-tests - addressed in versions 1.11.6-7, 1.11.6-8, 1.19.7-1, 1.19.7-2
buildah - addressed in versions 1.11.6-7, 1.11.6-8, 1.19.7-1, 1.19.7-2
IBM MQ Operator - addressed in versions 2.0.4, 2.1.0
conmon - addressed in versions 2.0.6-1, 2.0.15-1, 2.0.26-1, 2.0.26-3
container-selinux - addressed in versions 2.124.0-1, 2.130.0-1, 2.158.0-1, 2.162.0-1
podman-catatonit - addressed in versions 3.0.1-6, 3.0.1-7
podman-plugins - addressed in versions 3.0.1-6, 3.0.1-7
crit - addressed in versions 3.12-9, 3.15-1
python3-criu - addressed in versions 3.12-9, 3.15-1
criu - addressed in versions 3.12-9, 3.15-1
libslirp - update to 4.3.1-1
libslirp-devel - update to 4.3.1-1
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC VxRail Appliance - update to 7.0.240
Storage Ceph - update to 7.1
IBM supplied MQ Advanced container images - update to 9.3.1.0
cockpit-podman - addressed in versions 11-1, 29-2
Robotic Process Automation for Cloud Pak - update to 21.0.6

• https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r

• Security features bypass in Open Container Initiative runc
• Amazon Linux AMI update for runc
• Security features bypass in containerd
• Arch Linux update for runc
• Security restrictions bypass in OpenShift Container Platform
• Multiple vulnerabilities in OpenShift Container Platform
• Security restrictions bypass in Red Hat OpenShift Container Platform
• Security restrictions bypass in Red Hat OpenShift Container Platform
• Red Hat Enterprise Linux 7 Extras update for docker
• Red Hat Enterprise Linux 7 Extras update for runc
• Red Hat Enterprise Linux 8.2 update for the container-tools:2.0 module
• Red Hat Enterprise Linux 8.4 update for the container-tools:2.0 module
• Red Hat Enterprise Linux 8.4 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 8.4 update for the container-tools:3.0 module
• Security restrictions bypass in OpenShift Container Platform 3.11
• Gentoo update for runC
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• SUSE update for containerd, docker, runc
• SUSE update for containerd, docker, runc
• SUSE update for containerd, docker, runc
• Ubuntu update for runc
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• SUSE update for runc
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT
• openEuler 20.03 LTS SP1 update for runc
• Multiple vulnerabilities in IBM QRadar Suite software
• Multiple vulnerabilities in IBM Storage Ceph
• Fedora 34 update for runc
• Fedora 33 update for runc
• Anolis OS update for container-tools:2.0 (Anolis OS 8.2) module
• Anolis OS update for container-tools:2.0 (Anolis OS 8.4) module
• Anolis OS update for container-tools:an8 module
• Anolis OS update for container-tools:3.0 module
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data