CVE-2021-30465

Published: May 27, 2021Modified: Jun 17, 2026

8.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 6.0

Source: NVD

Description

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

Affected (18)

Products: Linuxfoundation: Runc · Fedoraproject: Fedora

Linuxfoundation

1 product

1 product

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Runc	Up to 0.1.1
Linuxfoundation Runc	Version 1.0.0 rc10
Linuxfoundation Runc	Version 1.0.0 rc1
Linuxfoundation Runc	Version 1.0.0 rc2
Linuxfoundation Runc	Version 1.0.0 rc3
Linuxfoundation Runc	Version 1.0.0 rc4
Linuxfoundation Runc	Version 1.0.0 rc5
Linuxfoundation Runc	Version 1.0.0 rc6
Linuxfoundation Runc	Version 1.0.0 rc7
Linuxfoundation Runc	Version 1.0.0 rc8
Linuxfoundation Runc	Version 1.0.0 rc90
Linuxfoundation Runc	Version 1.0.0 rc91
Linuxfoundation Runc	Version 1.0.0 rc92
Linuxfoundation Runc	Version 1.0.0 rc93
Linuxfoundation Runc	Version 1.0.0 rc94
Linuxfoundation Runc	Version 1.0.0 rc9

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Related CWEs

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (26)

http://www.openwall.com/lists/oss-security/2021/05/19/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/19/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/19/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/19/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://bugzilla.opensuse.org/show_bug.cgi?id=1185405

Source: cve@mitre.org

Issue Tracking

https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/opencontainers/runc/releases

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202107-26

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210708-0003/

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/19/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/19/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/19/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/19/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://bugzilla.opensuse.org/show_bug.cgi?id=1185405

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/opencontainers/runc/releases

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202107-26

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210708-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.