CVE-2021-30465: runc - Mount Symlink Exchange Vulnerability
Summary
CVE-2021-30465: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs. Affects github.com/opencontainers/runc versions < 1.0.0-rc95. Fixed in 1.0.0-rc95. How to fix ↓
Also tracked for
- runc · Debian:11
The same CVE-2021-30465 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is runc, a command-line tool for spawning and running containers according to the Open Container Initiative (OCI) specification. It is widely used as the default runtime for Docker and other containerization platforms. The vulnerability, identified as CVE-2021-30465, affects runc versions 1.0.0-rc94 and earlier.
Vulnerability Detail
The vulnerability in runc allows an attacker to conduct a symlink exchange attack, leading to the host filesystem being bind-mounted into the container. By exploiting a time-of-check-to-time-of-use (TOCTTOU) flaw, the attacker can trick runc into mounting outside of the container rootfs. This attack requires the attacker to have the ability to start containers with a custom volume configuration and share volumes with a specific volume configuration. While security mechanisms like LSMs (AppArmor/SELinux) and user namespaces can mitigate the impact, they do not completely prevent the attack. The vulnerability can be exploited in container orchestrators like Kubernetes by creating a symlink in a volume to a well-known directory and using that symlink as the target of a mount. This allows the attacker to bind-mount the host filesystem into the container.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0-rc95
This is the first release that contains the fix.
go get github.com/opencontainers/runc@v1.0.0-rc95Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. However, users can mitigate the impact by enforcing strict security profiles for running containers, such as reduced capabilities, not running code as root, user namespaces, and using AppArmor/SELinux and seccomp. These measures restrict the actions an attacker can perform in case of a container breakout.
Conclusion
The vulnerability in runc allows an attacker to mount the host filesystem into a container by exploiting a symlink exchange attack. It is crucial for users to update to runc version 1.0.0-rc95 to mitigate this vulnerability. Enforcing strict security profiles for running containers is also recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
runc is a command-line tool for spawning and running containers according to the Open Container Initiative (OCI) specification. It is widely used as the default runtime for Docker and other containerization platforms.
The vulnerability, identified as CVE-2021-30465, allows an attacker to conduct a symlink exchange attack, resulting in the host filesystem being bind-mounted into the container.
runc versions 1.0.0-rc94 and earlier are affected by this vulnerability.
The vulnerability can be exploited by an attacker who has the ability to start containers with a custom volume configuration and share volumes with a specific volume configuration. By creating a symlink in a volume to a well-known directory and using that symlink as the target of a mount, the attacker can bind-mount the host filesystem into the container.
The vulnerability has been patched in runc version 1.0.0-rc95. Users should update to this version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
