GO-2021-0087
Race condition in github.com/opencontainers/runc
At a glance
- Published
- Updated
- CVE
- CVE-2019-19921
- Aliases
- GHSA-fh74-hm69-rqjw
Description
A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/opencontainers/runc | introduced 0, fixed 1.0.0-rc9.0.20200122160610-2fc03cc11c77 |
References
- https://github.com/opencontainers/runc/pull/2207 FIX
- https://github.com/opencontainers/runc/commit/2fc03cc11c775b7a8b2e48d7ee447cb9bef32ad0 FIX
- https://github.com/opencontainers/runc/issues/2197 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |