Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2023-27561

CVE-2023-27561:
Opencontainers runc Incorrect Authorization vulnerability

7

CVSS Score

Basic Information

CVE ID
CVE-2023-27561
GHSA ID
GHSA-vpvm-3wq2-2wvm
EPSS Score
-
CWE
CWE-706
Published
3/3/2023
Updated
12/6/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/opencontainers/runcgo>= 1.0.0-rc95, < 1.1.51.1.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from a regression in path validation logic introduced by commit 0ca91f4 (CVE-2021-30465 fix), which switched to using SecureJoin for path resolution. This made previous symlink checks in prepareRootfs ineffective, as SecureJoin resolves symlinks before validation. The fix in commit 0d72adf moved symlink checks before SecureJoin usage, confirming the vulnerable pattern existed in the mount destination handling within prepareRootfs. The file path and function are explicitly referenced in vulnerability descriptions and patch commits.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

run* *.*.*-r*** t*rou** *.*.* **s In*orr**t ****ss *ontrol l***in* to *s**l*tion o* Privil***s, r*l*t** to `li**ont*in*r/root*s_linux.*o`. To *xploit t*is, *n *tt**k*r must ** **l* to sp*wn two *ont*in*rs wit* *ustom volum*-mount *on*i*ur*tions, *n*

Reasoning

T** vuln*r**ility st*ms *rom * r**r*ssion in p*t* v*li**tion lo*i* intro*u*** *y *ommit ******* (*V*-****-***** *ix), w*i** swit**** to usin* S**ur*Join *or p*t* r*solution. T*is m*** pr*vious symlink ****ks in pr*p*r*Root*s in*****tiv*, *s S**ur*Joi