Race Condition Affecting github.com/opencontainers/runc/libcontainer Open this link in a new tab package, versions <1.0.0-rc10
Do your applications use this vulnerable package?
2 Jan 2020
24 Dec 2019
How to fix?
github.com/opencontainers/runc/libcontainer to version 1.0.0-rc10 or higher.
github.com/opencontainers/runc/libcontainer is a package for a modern container runtime.
Affected versions of this package are vulnerable to Race Condition an attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization, by adding a symlink to the rootfs that points to a directory on the volume. The second container won't be able to see the actual mount, but it can race it by modifying the mount point on the volume.
This can be exploited for a full container breakout by racing readonly/mask mounts, allowing writes to dangerous paths like