Integer Overflow Vulnerability in runc Allows Namespace Bypass
Summary
CVE-2021-43784: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. Affects runc across 4 version ranges.
< 1.0.0~rc93+ds1-5+deb11u4
< 9c444070ec7bb83995dbc0185da68284da71c554
< d72d057ba794164c3cce9451a00b72a78b25e1ae
< f50369af4b571e358f20b139eea52d612eb55eed
Fixed in 1.0.0~rc93+ds1-5+deb11u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a command-line interface tool designed for spawning and managing containers on Linux systems, adhering to the Open Container Initiative (OCI) specifications. It plays a crucial role in containerization by providing the necessary functionalities for creating and managing container namespaces, which isolate processes and resources. However, runc has been found to have a vulnerability that could allow an attacker to bypass these namespace restrictions, particularly affecting environments that run untrusted container images.
Vulnerability Detail
The vulnerability, identified as CVE-2021-43784, arises from an integer overflow in the 16-bit length field used for byte array attributes in runc's internal netlink serialization system. This flaw exists in all versions of runc prior to 1.0.3. An attacker with control over the container's configuration can exploit this vulnerability by crafting a malicious byte array that exceeds the length limit, leading to an overflow. This overflow can cause the attribute contents to be misinterpreted as netlink messages, allowing the attacker to disable namespace protections and gain unauthorized access to system resources.
How To Fix
Minimum fixed version
1.0.0~rc93+ds1-5+deb11u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disallow untrusted namespace paths from your container configurations. This can be done by modifying your container runtime settings to restrict access to namespace paths that are not trusted, thereby mitigating the risk of this vulnerability until a proper update can be applied.
Conclusion
CVE-2021-43784 represents a significant security risk for users of runc, particularly in environments that utilize untrusted container images. It is crucial to update to version 1.0.3 or later to mitigate this vulnerability. Additionally, implementing the suggested workaround can provide temporary relief until an update is feasible.
See every vulnerability recorded for runc →
FAQ
CVE-2021-43784 is a vulnerability in runc that allows an attacker to bypass container namespace restrictions due to an integer overflow in the netlink serialization system.
All versions of runc prior to 1.0.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2021-43784 is 5.0, indicating a moderate severity level.
If an immediate update is not possible, you should implement the workaround by disallowing untrusted namespace paths in your container configurations.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
