A runc isolation container launch tool used in Docker and Kubernetes has a vulnerability (CVE-2021-30465) that allows access from the container to the host environment's primary file system. By manipulating symbolic links, it is possible to prepare an apparently harmless container configuration that will lead to bind-mounting an external file system within the container. The issue has been resolved in runc 1.0.0-rc95.
To exploit the vulnerability, an attacker must be able to launch containers with additional mount points in the configuration (for example, the issue can be reproduced in Kubernetes-based environments where users can launch their containers). Due to a time window between checking and using mount points on partitions shared with other containers, the attacker can take advantage of a race condition during the container startup to replace the directory used for mounting in the container with a symbolic link to the area outside the container's root file system.
Forrás: opennet.ru
