-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability (CVE-2024-45310) in runc stems from a race condition when using os.MkdirAll and os.OpenFile(O_CREATE) to create directories and files for container mounts and device nodes. An attacker could manipulate symlinks in the path between the security check (e.g., SecureJoin) and the actual filesystem operation, causing runc to create empty files/directories outside the intended container rootfs. The analysis of the provided patches (commits 63c2908164f3a1daea455bf5bcd8d363d70328c7, 8781993968fd964ac723ff5f360b6f259e809a3e, f0b652ea61ff6750a8fcc69865d45a7abf37accf, and 1410a6988d439ed2e17d5860cb95b8e50ed08a81) reveals that the vulnerable functions are those that directly invoked these Go standard library functions on potentially attacker-influenced paths. The patches replace these calls with new utility functions (utils.MkdirAllInRoot, utils.MkdirAllInRootOpen, and system.Mkdirat/unix.Mknodat) that are designed to be safe against such symlink race attacks by operating within the validated rootfs and using file descriptor-based operations where possible.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/opencontainers/runc | go | < 1.1.14 | 1.1.14 |
| github.com/opencontainers/runc | go | >= 1.2.0-rc.1, < 1.2.0-rc.3 | 1.2.0-rc.3 |
Thanks to Rodrigo Campos Catelin (@rata) and Alban Crequy (@alban) from Microsoft for discovering and reporting this vulnerability.
Ongoing coverage of React2Shell