Cloudanix VulnDB

CVE-2024-45310

None

CVSS

—

EPSS

0.3%

Published

Sep 3, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the software that runs containers can let someone who starts containers create empty files or folders anywhere on the host computer, which could be used to interfere with the underlying system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Tampering
Component
Container Runtime
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in runc allows an attacker sharing a volume between containers to exploit os.MkdirAll and create empty files or directories at arbitrary host filesystem locations; existing files are not truncated and user namespaces or strict LSM policies can reduce scope.

Why it matters to the business

Attackers with container creation privileges can tamper with host filesystem paths, risking container breakout or persistence in environments using Docker, Kubernetes or direct runc, increasing operational risk until patched.

How an attack unfolds

An attacker with ability to launch containers using custom volume mounts starts two containers sharing a volume, then races the os.MkdirAll call to create empty inodes at chosen host paths; the flaw affects both direct runc use and orchestration layers.

How to fix it

Upgrade runc to v1.1.14 or v1.2.0-rc3; enable user namespaces to limit writable directories; apply strict SELinux or AppArmor policies on the runc runtime.

How to confirm the fix worked

Confirm runc binary version is 1.1.14 or newer; test that shared-volume race attempts no longer create host inodes outside intended paths; review container runtime logs for volume mount patterns.

Typical attack path

  1. Obtain privileges to start containers with custom volume configuration
  2. Launch two containers sharing a volume mount point
  3. Trigger concurrent os.MkdirAll operations to win the race condition
  4. Create empty files or directories at arbitrary host filesystem locations

How to detect it

Review container runtime audit logs and orchestration platform events for unusual volume mount patterns or repeated container starts involving shared directories; look for unexpected empty files or directories appearing in host paths after container activity.

What your security team should do

  • Immediately upgrade all runc installations to the fixed versions
  • Enable user namespaces for containers where feasible
  • Enforce strict LSM policies on runc processes
  • Audit custom volume configurations in Kubernetes and Docker deployments
  • Monitor for new container runtime releases and apply within change windows

The record

runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3. Some workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual user on the host (such as with rootless containers that don't use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/opencontainers/runc 0 1.1.14
Go github.com/opencontainers/runc 1.2.0-rc.1 1.2.0-rc.3
Chainguard buildah 0 1.37.2-r1
Chainguard cadvisor 0 0.50.0-r2
Chainguard cadvisor-compat 0 0.50.0-r2
Chainguard cadvisor-fips 0 0.50.0-r2
Chainguard cluster-autoscaler-1.31 0 1.31.5-r1
Chainguard cluster-autoscaler-1.31-compat 0 1.31.5-r1
Chainguard cluster-autoscaler-fips-1.31 0 1.31.2-r0
Chainguard cluster-autoscaler-fips-1.31-compat 0 1.31.2-r0
Chainguard ctop 0 0.7.7-r19
Chainguard docker 0 27.2.0-r1
Chainguard docker-config-mirror-gcr 0 27.2.0-r1
Chainguard docker-dind 0 27.2.0-r1
Chainguard docker-dind-compat 0 27.2.0-r1
Chainguard docker-init 0 27.2.0-r1
Chainguard docker-modprobe-compat 0 27.2.0-r1
Chainguard docker-oci-entrypoint 0 27.2.0-r1
Chainguard docker-rootless 0 27.2.0-r1
Chainguard dockerd 0 27.2.0-r1
Chainguard dockerd-oci-entrypoint 0 27.2.0-r1
Chainguard dockerd-service 0 27.2.0-r1
Chainguard eks-distro-1.31 0 1.31.33-r0
Chainguard eks-distro-1.31 0 1.31.35-r1
Chainguard eks-distro-coredns-1.31 0 1.31.33-r0
Chainguard eks-distro-coredns-1.31 0 1.31.35-r1
Chainguard eks-distro-coredns-fips-1.31 0 1.31.33-r0
Chainguard eks-distro-coredns-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-fips-1.31 0 1.31.33-r0
Chainguard eks-distro-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-apiserver-1.31 0 1.31.33-r0
Chainguard eks-distro-kube-apiserver-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-apiserver-fips-1.31 0 1.31.33-r0
Chainguard eks-distro-kube-apiserver-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-controller-manager-1.31 0 1.31.33-r0
Chainguard eks-distro-kube-controller-manager-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-controller-manager-fips-1.31 0 1.31.33-r0
Chainguard eks-distro-kube-controller-manager-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-proxy-1.31 0 1.31.33-r0
Chainguard eks-distro-kube-proxy-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-proxy-fips-1.31 0 1.31.33-r0
Chainguard eks-distro-kube-proxy-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-scheduler-1.31 0 1.31.33-r0
Chainguard eks-distro-kube-scheduler-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-scheduler-fips-1.31 0 1.31.33-r0
Chainguard eks-distro-kube-scheduler-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-kubernetes-pause-1.31 0 1.31.33-r0
Chainguard eks-distro-kubernetes-pause-1.31 0 1.31.35-r1
Chainguard gosu-1.11 0 1.11-r3
Chainguard gpu-feature-discovery 0 0.8.2-r5
Chainguard grafana-alloy 0 1.3.1-r1
Chainguard grafana-alloy-compat 0 1.3.1-r1
Chainguard grafana-alloy-fips 0 1.3.1-r1
Chainguard grype 0 0.80.0-r1
Chainguard ingress-nginx-controller-1.10 0 1.10.4-r1
Chainguard ingress-nginx-controller-1.10-compat 0 1.10.4-r1
Chainguard ingress-nginx-controller-1.10-kube-webhook-certgen 0 1.10.4-r1
Chainguard ingress-nginx-controller-1.11 0 1.11.2-r1
Chainguard ingress-nginx-controller-1.11-compat 0 1.11.2-r1
Chainguard ingress-nginx-controller-1.11-kube-webhook-certgen 0 1.11.2-r1
Chainguard ingress-nginx-controller-bitnami-compat-1.10 0 1.10.4-r1
Chainguard ingress-nginx-controller-bitnami-compat-1.11 0 1.11.2-r1
Chainguard ingress-nginx-controller-compat-1.10 0 1.10.4-r1
Chainguard ingress-nginx-controller-compat-1.11 0 1.11.2-r1
Chainguard ingress-nginx-controller-fips-1.10 0 1.10.4-r1
Chainguard ingress-nginx-controller-fips-1.11 0 1.11.2-r1
Chainguard ingress-nginx-controller-fips-bitnami-compat-1.11 0 1.11.2-r1
Chainguard ingress-nginx-controller-fips-compat-1.11 0 1.11.2-r1
Chainguard ingress-nginx-controller-fips-iamguarded-compat-1.11 0 1.11.2-r1
Chainguard ingress-nginx-controller-iamguarded-compat-1.11 0 1.11.2-r1
Chainguard ingress-nginx-custom-error-pages-1.10 0 1.10.4-r1
Chainguard ingress-nginx-custom-error-pages-1.11 0 1.11.2-r1
Chainguard ingress-nginx-custom-error-pages-compat-1.10 0 1.10.4-r1
Chainguard ingress-nginx-custom-error-pages-compat-1.11 0 1.11.2-r1
Chainguard ingress-nginx-custom-error-pages-fips-1.10 0 1.10.4-r1
Chainguard ingress-nginx-custom-error-pages-fips-1.11 0 1.11.2-r1
Chainguard ingress-nginx-fips-custom-error-pages-1.11 0 1.11.2-r1
Chainguard ingress-nginx-fips-custom-error-pages-compat-1.11 0 1.11.2-r1
Chainguard ingress-nginx-fips-opentelemetry-plugin-1.11 0 1.11.2-r1
Chainguard ingress-nginx-opentelemetry-1.11 0 1.11.2-r1
Chainguard ingress-nginx-opentelemetry-compat-1.11 0 1.11.2-r1
Chainguard ingress-nginx-opentelemetry-plugin-1.10 0 1.10.4-r1
Chainguard ingress-nginx-opentelemetry-plugin-1.11 0 1.11.2-r1
Chainguard k3s 0 1.31.0.1-r1
Chainguard k3s-embedded 0 1.31.0.1-r1
Chainguard k3s-images 0 1.31.0.1-r1
Chainguard k3s-multicall 0 1.31.0.1-r1
Chainguard k3s-static 0 1.31.0.1-r1
Chainguard kube-apiserver-1.28 0 1.28.15-r11
Chainguard kube-apiserver-1.28-default 0 1.28.15-r11
Chainguard kube-apiserver-1.29 0 1.29.15-r2
Chainguard kube-apiserver-1.29-default 0 1.29.15-r2
Chainguard kube-apiserver-1.30 0 1.30.11-r2
Chainguard kube-apiserver-1.30-default 0 1.30.11-r2
Chainguard kube-apiserver-1.30-default-compat 0 1.30.11-r2
Chainguard kube-apiserver-1.31 0 1.31.14-r0
Chainguard kube-apiserver-1.31-default 0 1.31.14-r0
Chainguard kube-apiserver-1.31-default-compat 0 1.31.14-r0
Chainguard kube-apiserver-fips-1.28 0 1.28.15-r1
Chainguard kube-apiserver-fips-1.28-default 0 1.28.15-r1
Chainguard kube-apiserver-fips-1.29 0 1.29.10-r1
Chainguard kube-apiserver-fips-1.29-default 0 1.29.10-r1
Chainguard kube-apiserver-fips-1.30 0 1.30.11-r2
Chainguard kube-apiserver-fips-1.30-default 0 1.30.11-r2
Chainguard kube-apiserver-fips-1.30-default-compat 0 1.30.11-r2
Chainguard kube-apiserver-fips-1.31 0 1.31.7-r2
Chainguard kube-apiserver-fips-1.31-default 0 1.31.7-r2
Chainguard kube-apiserver-fips-1.31-default-compat 0 1.31.7-r2
Chainguard kube-controller-manager-1.28 0 1.28.15-r11
Chainguard kube-controller-manager-1.28-default 0 1.28.15-r11
Chainguard kube-controller-manager-1.29 0 1.29.15-r2
Chainguard kube-controller-manager-1.29-default 0 1.29.15-r2
Chainguard kube-controller-manager-1.30 0 1.30.11-r2
Chainguard kube-controller-manager-1.30-default 0 1.30.11-r2
Chainguard kube-controller-manager-1.30-default-compat 0 1.30.11-r2
Chainguard kube-controller-manager-1.31 0 1.31.14-r0
Chainguard kube-controller-manager-1.31-default 0 1.31.14-r0
Chainguard kube-controller-manager-1.31-default-compat 0 1.31.14-r0
Chainguard kube-controller-manager-fips-1.28 0 1.28.15-r1
Chainguard kube-controller-manager-fips-1.28-default 0 1.28.15-r1
Chainguard kube-controller-manager-fips-1.29 0 1.29.10-r1
Chainguard kube-controller-manager-fips-1.29-default 0 1.29.10-r1
Chainguard kube-controller-manager-fips-1.30 0 1.30.11-r2
Chainguard kube-controller-manager-fips-1.30-default 0 1.30.11-r2
Chainguard kube-controller-manager-fips-1.30-default-compat 0 1.30.11-r2
Chainguard kube-controller-manager-fips-1.31 0 1.31.7-r2
Chainguard kube-controller-manager-fips-1.31-default 0 1.31.7-r2
Chainguard kube-controller-manager-fips-1.31-default-compat 0 1.31.7-r2
Chainguard kube-proxy-1.28 0 1.28.15-r11
Chainguard kube-proxy-1.28-default 0 1.28.15-r11
Chainguard kube-proxy-1.28-default-compat 0 1.28.15-r11
Chainguard kube-proxy-1.29 0 1.29.15-r2
Chainguard kube-proxy-1.29-default 0 1.29.15-r2
Chainguard kube-proxy-1.29-default-compat 0 1.29.15-r2
Chainguard kube-proxy-1.30 0 1.30.11-r2
Chainguard kube-proxy-1.30-default 0 1.30.11-r2
Chainguard kube-proxy-1.30-default-compat 0 1.30.11-r2
Chainguard kube-proxy-1.31 0 1.31.14-r0
Chainguard kube-proxy-1.31-default 0 1.31.14-r0
Chainguard kube-proxy-1.31-default-compat 0 1.31.14-r0
Chainguard kube-proxy-fips-1.28 0 1.28.15-r1
Chainguard kube-proxy-fips-1.28-default 0 1.28.15-r1
Chainguard kube-proxy-fips-1.29 0 1.29.10-r1
Chainguard kube-proxy-fips-1.29-default 0 1.29.10-r1
Chainguard kube-proxy-fips-1.30 0 1.30.11-r2
Chainguard kube-proxy-fips-1.30-default 0 1.30.11-r2
Chainguard kube-proxy-fips-1.30-default-compat 0 1.30.11-r2
Chainguard kube-proxy-fips-1.31 0 1.31.7-r2
Chainguard kube-proxy-fips-1.31-default 0 1.31.7-r2
Chainguard kube-proxy-fips-1.31-default-compat 0 1.31.7-r2
Chainguard kube-scheduler-1.28 0 1.28.15-r11
Chainguard kube-scheduler-1.28-default 0 1.28.15-r11
Chainguard kube-scheduler-1.29 0 1.29.15-r2
Chainguard kube-scheduler-1.29-default 0 1.29.15-r2
Chainguard kube-scheduler-1.30 0 1.30.11-r2
Chainguard kube-scheduler-1.30-default 0 1.30.11-r2
Chainguard kube-scheduler-1.30-default-compat 0 1.30.11-r2
Chainguard kube-scheduler-1.31 0 1.31.14-r0
Chainguard kube-scheduler-1.31-default 0 1.31.14-r0
Chainguard kube-scheduler-1.31-default-compat 0 1.31.14-r0
Chainguard kube-scheduler-fips-1.28 0 1.28.15-r1
Chainguard kube-scheduler-fips-1.28-default 0 1.28.15-r1
Chainguard kube-scheduler-fips-1.29 0 1.29.10-r1
Chainguard kube-scheduler-fips-1.29-default 0 1.29.10-r1
Chainguard kube-scheduler-fips-1.30 0 1.30.11-r2
Chainguard kube-scheduler-fips-1.30-default 0 1.30.11-r2
Chainguard kube-scheduler-fips-1.30-default-compat 0 1.30.11-r2
Chainguard kube-scheduler-fips-1.31 0 1.31.7-r2
Chainguard kube-scheduler-fips-1.31-default 0 1.31.7-r2
Chainguard kube-scheduler-fips-1.31-default-compat 0 1.31.7-r2
Chainguard kube-webhook-certgen-1.10 0 1.10.4-r1
Chainguard kube-webhook-certgen-1.11 0 1.11.2-r1
Chainguard kube-webhook-certgen-fips-1.10 0 1.10.4-r1
Chainguard kube-webhook-certgen-fips-1.11 0 1.11.2-r1
Chainguard kubeadm-1.28 0 1.28.15-r11
Chainguard kubeadm-1.28-default 0 1.28.15-r11
Chainguard kubeadm-1.29 0 1.29.15-r2
Chainguard kubeadm-1.29-default 0 1.29.15-r2
Chainguard kubeadm-1.30 0 1.30.11-r2
Chainguard kubeadm-1.30-default 0 1.30.11-r2
Chainguard kubeadm-1.30-default-compat 0 1.30.11-r2
Chainguard kubeadm-1.31 0 1.31.14-r0
Chainguard kubeadm-1.31-default 0 1.31.14-r0
Chainguard kubeadm-1.31-default-compat 0 1.31.14-r0
Chainguard kubeadm-fips-1.28 0 1.28.15-r1
Chainguard kubeadm-fips-1.28-default 0 1.28.15-r1
Chainguard kubeadm-fips-1.29 0 1.29.10-r1
Chainguard kubeadm-fips-1.29-default 0 1.29.10-r1
Chainguard kubeadm-fips-1.30 0 1.30.11-r2
Chainguard kubeadm-fips-1.30-default 0 1.30.11-r2
Chainguard kubeadm-fips-1.30-default-compat 0 1.30.11-r2
Chainguard kubeadm-fips-1.31 0 1.31.7-r2
Chainguard kubeadm-fips-1.31-default 0 1.31.7-r2
Chainguard kubeadm-fips-1.31-default-compat 0 1.31.7-r2
Chainguard kubectl-1.28 0 1.28.15-r11
Chainguard kubectl-1.28-bitnami-compat 0 1.28.15-r11
Chainguard kubectl-1.28-default 0 1.28.15-r11
Chainguard kubectl-1.29 0 1.29.15-r2
Chainguard kubectl-1.29-bitnami-compat 0 1.29.15-r2
Chainguard kubectl-1.29-default 0 1.29.15-r2

Related vulnerabilities