GO-2021-0087

Source
https://pkg.go.dev/vuln/GO-2021-0087
Import Source
https://vuln.go.dev/ID/GO-2021-0087.json
Aliases
Published
2021-04-14T20:04:52Z
Modified
2023-11-08T04:01:29.896999Z
Details

A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.

References

Affected packages

Go / github.com/opencontainers/runc

Package

Name
github.com/opencontainers/runc

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.0.0-rc9.0.20200122160610-2fc03cc11c77

Ecosystem specific 

{
    "imports": [
        {
            "path": "github.com/opencontainers/runc/libcontainer",
            "symbols": [
                "mountToRootfs"
            ]
        }
    ]
}