CVE-2021-30465

{"id": "CVE-2021-30465", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "published": "2021-05-27T13:15:08.077", "references": [{"url": "http://www.openwall.com/lists/oss-security/2021/05/19/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2021/05/19/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugzilla.opensuse.org/show_bug.cgi?id=1185405", "tags": ["Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/opencontainers/runc/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html", "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH/", "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV/", "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/202107-26", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.netapp.com/advisory/ntap-20210708-0003/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2021/05/19/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2021/05/19/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.opensuse.org/show_bug.cgi?id=1185405", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/opencontainers/runc/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/202107-26", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20210708-0003/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition."}, {"lang": "es", "value": "runc versiones anteriores a 1.0.0-rc95, permite un Container Filesystem Breakout por medio de un Salto de Directorio. Para explotar la vulnerabilidad, un atacante debe ser capaz de crear varios contenedores con una configuraci\u00f3n de montaje bastante espec\u00edfica. El problema ocurre por medio de un ataque de intercambio de enlaces simb\u00f3licos que se basa en una condici\u00f3n de carrera"}], "lastModified": "2024-11-21T06:03:58.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D522E8C1-E7F0-4A3D-AF68-6D962944A0E5", "versionEndIncluding": "0.1.1"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "949172CC-EBB5-47F6-B987-207C802EED0F"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E890B4D-9270-428B-8143-9B5124F0F96E"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6D87B50-2849-4F4D-A0F9-4F7EBA3C2647"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E580E25-F94C-4DA4-8718-15D5F1C3ADAF"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD565CE0-D9E9-4FD9-8998-8AC55030FAB7"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "093326B1-448C-4E3B-886D-CAC8B6813BFF"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F672C421-789D-4F21-B483-DA3EB251BA1D"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E13C190A-D7CE-4204-8CEF-B7317D3FFBF9"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15AEA3E2-A82F-4562-AFE6-B83A767B94E7"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB5109FF-7C41-477E-B817-F63F06D866C3"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc90:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6B8085F-4B68-47E4-8B4B-FB8C2742EEF4"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc91:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "978AFEA7-C64F-4B24-B314-4E0E7D5C521A"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc92:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A134E568-C11C-4D12-9B61-BFA58A080B96"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc93:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FAC79BA-7A2A-45E3-8806-E2C812991ACC"}, {"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc94:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "151570F5-F04B-4F31-AE6E-F364FC8AC01C"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}