Bug 2175721 (CVE-2023-27561)

Summary:	CVE-2023-27561 runc: volume mount race condition (regression of CVE-2019-19921)
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, jburrell, jnovy, joelsmith, kir, lgamliel, lsm5, mpatel, rfreiman, rogbas, trathi, tsweeney, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	runc 1.1.5	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in runc. An attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization by adding a symlink to the rootfs that points to a directory on the volume.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2175994, 2175995, 2175996, 2175997, 2176107, 2176108, 2176109, 2176110
Bug Blocks:	2175722

Description Mauro Matteo Cascella 2023-03-06 12:45:07 UTC

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

References:
https://github.com/opencontainers/runc/issues/3751
https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9
https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334

Comment 2 Avinash Hanwate 2023-03-07 04:49:24 UTC

Created cadvisor tracking bugs for this issue:

Affects: fedora-all [bug 2175995]


Created golang-github-opencontainers-runc tracking bugs for this issue:

Affects: fedora-all [bug 2175996]


Created origin tracking bugs for this issue:

Affects: fedora-all [bug 2175997]


Created runc tracking bugs for this issue:

Affects: fedora-all [bug 2175994]

Comment 9 errata-xmlrpc 2023-05-17 22:31:31 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:1326 https://access.redhat.com/errata/RHSA-2023:1326

Comment 10 errata-xmlrpc 2023-06-23 04:39:38 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:3612 https://access.redhat.com/errata/RHSA-2023:3612

Comment 13 errata-xmlrpc 2023-07-20 17:28:50 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13
  Ironic content for Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:4093 https://access.redhat.com/errata/RHSA-2023:4093

Comment 16 errata-xmlrpc 2023-10-31 12:54:31 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2023:5006 https://access.redhat.com/errata/RHSA-2023:5006

Comment 17 errata-xmlrpc 2023-11-07 08:14:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6380 https://access.redhat.com/errata/RHSA-2023:6380

Comment 18 errata-xmlrpc 2023-11-14 15:16:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:6938 https://access.redhat.com/errata/RHSA-2023:6938

Comment 19 errata-xmlrpc 2023-11-14 15:16:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:6939 https://access.redhat.com/errata/RHSA-2023:6939