CVE-2021-43784: Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in github.com/opencontainers/runc
Summary
CVE-2021-43784: Impact In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the C portion of our code (responsible for the based namespace setup of containers). Affects github.com/opencontainers/runc versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Also tracked for
- runc · Debian:11
The same CVE-2021-43784 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/opencontainers/runc is an open-source project written in Go that provides a lightweight container runtime for Linux. It is widely used by containerization platforms and allows users to create and manage containers with isolated namespaces. The vulnerability described in this report affects all versions of runc prior to 1.0.3.
Vulnerability Detail
The vulnerability in runc arises from an integer overflow in the 16-bit length field for the byte array attribute type used by the netlink serialization system. This flaw allows an attacker with control over the container configuration to override the netlink-based container setup and bypass namespace restrictions. By injecting a malicious netlink payload, the attacker can disable all namespaces and gain unauthorized access to the host system. While the practical exploitability of this vulnerability is limited in earlier versions of runc, it becomes significantly more exploitable in recent versions where mount paths are included as a large netlink message.
How To Fix
Minimum fixed version
1.0.3
This is the first release that contains the fix.
go get github.com/opencontainers/runc@v1.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the risk of this vulnerability, it is recommended to disallow untrusted namespace paths in container configurations. By preventing the use of untrusted namespace paths, the attacker's ability to exploit this vulnerability is eliminated. It should be noted that allowing untrusted namespace paths already poses a significant security risk, as it enables an attacker to disable namespace protections even without this specific vulnerability.
Conclusion
The vulnerability in github.com/opencontainers/runc prior to version 1.0.3 allows an attacker to override netlink-based container configuration and bypass namespace restrictions. While the practical exploitability of this vulnerability is limited in earlier versions, recent versions make it significantly more exploitable. Users are strongly advised to update their runc installation to version 1.0.3 or later to mitigate the risk. Disabling untrusted namespace paths in container configurations is also recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
This vulnerability allows an attacker to bypass namespace restrictions in runc containers and gain unauthorized access to the host system. However, the practical exploitability of this vulnerability is limited in earlier versions of runc.
Users who allow untrusted images with untrusted configurations to run on their machines are primarily impacted by this vulnerability. This includes shared cloud infrastructure where untrusted containers can be deployed.
Disabling untrusted namespace paths in container configurations eliminates the practical ways of exploiting this vulnerability. However, it is important to note that allowing untrusted namespace paths already poses a significant security risk.
Yes, the vulnerability has been fixed in runc version 1.0.3. Users are advised to update their runc installation to the latest version to mitigate the risk.
This vulnerability was discovered and reported by Felix Wilhelm from Google Project Zero. Their quick identification of this vulnerability before the release of runc 1.1 was commendable.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.