Skip to content
Fencer Vulns
high 8.5

CVE-2021-30465 in the critical feed json

mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs

published 2021-05-25 5 y ago modified 2026-09-10 1 mo ago also GHSA-c3xm-pvg7-gh7r , GO-2022-0914 , EUVD-2021-1034

cvss
8.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
10.2%
EPSS 10.2% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

Patch / fix

  • go github.com/opencontainers/runc 1.0.0-rc95
  • runc Debian 14, Debian 13, Debian 12 1.0.0~rc93+ds1-5

debian advisories DEBIAN-CVE-2021-30465

  • runc Ubuntu 18.04 LTS 1.0.0~rc93-0ubuntu1~18.04.2
  • runc Ubuntu 20.04 LTS 1.0.0~rc93-0ubuntu1~20.04.2
  • runc Ubuntu Pro 16.04 LTS 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2

ubuntu advisories UBUNTU-CVE-2021-30465

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • runc openshift 4.8 1.0.0-98.rhaos4.8.gitcd80260.el7
  • runc openshift 4.8 1.0.0-98.rhaos4.8.gitcd80260.el8
  • cri-o openshift 4.8 1.21.2-5.rhaos4.8.gitb27d974.el7
  • cri-o openshift 4.8 1.21.2-5.rhaos4.8.gitb27d974.el8
  • butane openshift 4.8 0.12.1-1.rhaos4.8.el8
  • ostree openshift 4.8 2020.7-5.el8_4
  • podman openshift 4.8 3.0.1-6.el8
  • haproxy openshift 4.8 2.2.13-1.el7

red hat advisories RHSA-2021:2437RHSA-2021:2370RHSA-2021:2371RHSA-2021:2291RHSA-2021:2292RHSA-2021:2150

  • runc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 1.0.2-23.1
  • docker SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 20.10.9_ce-156.1
  • containerd SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 1.4.11-56.1
  • runc SLE Module for Containers 12 1.0.2-16.14.1
  • docker SLE Module for Containers 12 20.10.9_ce-98.72.1
  • containerd SLE Module for Containers 12 1.4.11-16.45.1
  • runc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +14 more 1.0.0~rc93-1.14.2
  • docker SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +13 more 20.10.6_ce-6.49.3

suse advisories SUSE-SU-2021:3506-1SUSE-SU-2021:3336-1SUSE-SU-2021:1954-1SUSE-SU-2021:1885-1

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250807T150727-1.1
  • runc openSUSE Tumbleweed 1.0.2-1.2
  • runc openSUSE Leap 15.2 1.0.2-lp152.2.9.1
  • docker openSUSE Leap 15.2 20.10.9_ce-lp152.2.18.1
  • containerd openSUSE Leap 15.2 1.4.11-lp152.2.12.1
  • runc openSUSE Leap 15.3 1.0.2-23.1
  • docker openSUSE Leap 15.3 20.10.9_ce-156.1
  • containerd openSUSE Leap 15.3 1.4.11-56.1

opensuse advisories openSUSE-SU-2025:15424-1openSUSE-SU-2024:11358-1openSUSE-SU-2021:1404-1openSUSE-SU-2021:3506-1openSUSE-SU-2021:1954-1openSUSE-SU-2021:0878-1

  • crit AlmaLinux 8 3.15-1.module_el8.6.0+2876+9ed4eae2
  • criu AlmaLinux 8 3.15-1.module_el8.6.0+2876+9ed4eae2
  • udica AlmaLinux 8 0.2.4-1.module_el8.6.0+2876+9ed4eae2
  • conmon AlmaLinux 8 2:2.0.26-3.module_el8.7.0+3406+a17c4180
  • libslirp AlmaLinux 8 4.3.1-1.module_el8.6.0+2876+9ed4eae2
  • slirp4netns AlmaLinux 8 1.1.8-1.module_el8.6.0+2876+9ed4eae2
  • python3-criu AlmaLinux 8 3.15-1.module_el8.6.0+2876+9ed4eae2
  • cockpit-podman AlmaLinux 8 29-2.module_el8.6.0+2876+9ed4eae2

almalinux advisories ALSA-2021:2371ALSA-2021:2370ALSA-2021:2291

  • criu Rocky Linux 8 3.15-1.module+el8.7.0+1076+9b1c11c1
  • criu Rocky Linux 8 3.15-1.module+el8.4.0+556+40122d08
  • criu Rocky Linux 8 3.15-1.module+el8.5.0+709+440d5e7e
  • criu Rocky Linux 8 3.15-1.module+el8.6.0+783+10209741
  • crun Rocky Linux 8 0.18-2.module+el8.4.0+556+40122d08
  • crun Rocky Linux 8 0.18-2.module+el8.5.0+709+440d5e7e
  • runc Rocky Linux 8 1.0.0-73.rc93.module+el8.4.0+556+40122d08
  • udica Rocky Linux 8 0.2.4-1.module+el8.7.0+1076+9b1c11c1

rocky linux advisories RLSA-2021:2371RLSA-2021:2370RLSA-2021:2291

  • k3s Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 1.21.1.1-r0
  • runc Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 1.0.0_rc95-r0

alpine advisories ALPINE-CVE-2021-30465

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • buildah Azure Linux 3.0 1.41.4-2

azure linux advisories AZL-44262

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • runc Arch Linux 1.0.0rc95-1

arch linux advisories AVG-1972

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-30465 updated cvss 7.5

runc: vulnerable to symlink exchange attack

  • Red Hat Enterprise Linux 8 runc
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 Extras runc 1.0.0-69.rc10.el7_9, docker 1.13.1-206.git7d71120.el7_9, docker-client 1.13.1-206.git7d71120.el7_9, docker-common 1.13.1-206.git7d71120.el7_9, docker-logrotate 1.13.1-206.git7d71120.el7_9, docker-lvm-plugin 1.13.1-206.git7d71120.el7_9, +3 more
    fixed: vendor fix RHSA-2021:2144
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.12-9.module+el8.4.0+10193+e90fd8eb, crit 3.15-1.module+el8.4.0+11310+8c67a752, crit 3.15-1.module+el8.4.0+11311+9da8acfb, criu 3.12-9.module+el8.4.0+10193+e90fd8eb, criu 3.15-1.module+el8.4.0+11310+8c67a752, criu 3.15-1.module+el8.4.0+11311+9da8acfb, +68 more
    fixed: vendor fix RHSA-2021:2291
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) crit 3.12-9.module+el8.2.0+11121+714aca16, criu 3.12-9.module+el8.2.0+11121+714aca16, udica 0.2.1-2.module+el8.2.0+11121+714aca16, conmon 2.0.6-1.module+el8.2.0+11121+714aca16, podman 1.6.4-19.module+el8.2.0+11121+714aca16, skopeo 0.1.40-9.module+el8.2.0+11121+714aca16, +16 more
    fixed: vendor fix RHSA-2021:2292
  • Red Hat OpenShift Container Platform 3.11 runc 1.0.0-69.rc10.el7_9
    fixed: vendor fix RHSA-2021:2150
  • Red Hat OpenShift Container Platform 4.5 runc 1.0.0-74.rhaos4.5.gitd2c3b70.el7, runc 1.0.0-74.rhaos4.5.gitd2c3b70.el8, openshift 4.5.0-202105121820.p0.git.d8ef5ad.el7, openshift 4.5.0-202105121820.p0.git.d8ef5ad.el8, openshift-hyperkube 4.5.0-202105121820.p0.git.d8ef5ad.el7, openshift-hyperkube 4.5.0-202105121820.p0.git.d8ef5ad.el8
    fixed: vendor fix RHSA-2021:2057
  • Red Hat OpenShift Container Platform 4.6 runc 1.0.0-87.rhaos4.6.git23384e2.el7, runc 1.0.0-87.rhaos4.6.git23384e2.el8, openshift 4.6.0-202105150940.p0.git.9caf8fe.el7, openshift 4.6.0-202105150940.p0.git.9caf8fe.el8, openshift-hyperkube 4.6.0-202105150940.p0.git.9caf8fe.el7, openshift-hyperkube 4.6.0-202105150940.p0.git.9caf8fe.el8
    fixed: vendor fix RHSA-2021:1566
  • Red Hat OpenShift Container Platform 4.7 runc 1.0.0-96.rhaos4.8.gitcd80260.el7, runc 1.0.0-96.rhaos4.8.gitcd80260.el8
    fixed: vendor fix RHSA-2021:1562
show 2 more
  • Red Hat OpenShift Container Platform 4.8 podman 3.0.1-6.el8, haproxy 2.2.13-1.el7, haproxy 2.2.13-1.el8, ostree 2020.7-5.el8_4, cri-tools 1.21.0-2.el7, cri-tools 1.21.0-2.el8, +134 more
    fixed: vendor fix RHSA-2021:2437
  • Red Hat Advanced Cluster Management for Kubernetes 2 multicloud-operators-subscription, multicloud-operators-subscription-release Red Hat Enterprise Linux 9 runc Red Hat OpenShift Container Platform 3.11 prometheus 3.11.452-1.git.99aae51.el7, openshift-kuryr 3.11.452-1.git.c33a657.el7, atomic-openshift 3.11.452-1.git.0.a782948.el7, openshift-ansible 3.11.452-1.git.0.304c046.el7, openshift-kuryr-cni 3.11.452-1.git.c33a657.el7, atomic-openshift-pod 3.11.452-1.git.0.a782948.el7, +34 more Red Hat OpenShift Container Platform 4.7 jenkins 2.277.3.1620985335-1.el8, openshift 4.7.0-202105160013.p0.git.df9c838.el7, openshift 4.7.0-202105160013.p0.git.df9c838.el8, openshift-kuryr 4.7.0-202105140104.p0.git.8b61936.el8, openshift-hyperkube 4.7.0-202105160013.p0.git.df9c838.el7, openshift-hyperkube 4.7.0-202105160013.p0.git.df9c838.el8, +4 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

10.24% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P
GitHub 3.1 7.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/opencontainers/runc
<1.0.0-rc95
1.0.0-rc95

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.