Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a sophisticated race condition (TOCTOU) that allows an attacker to trick runc into writing to an arbitrary file within the procfs filesystem. This is achieved by manipulating mount points or symbolic links between the time runc checks a path and the time it writes to it.
The analysis of the patches reveals several key areas where runc performed unsafe operations on procfs using string-based paths.
Direct Procfs Writes: Functions like setProcAttr in libcontainer/apparmor/apparmor_linux.go and the now-removed writeSystemProperty in libcontainer/rootfs_linux.go directly constructed paths to files in /proc and wrote to them. An attacker could race these operations to redirect the write to a sensitive file, leading to denial of service (by writing to /proc/sysrq-trigger) or container escape (by writing to /proc/sys/kernel/core_pattern). The same pattern was present in the vendored go-selinux library in functions like SetExecLabel.
Racy Mount Setup: The mountToRootfs function in libcontainer/rootfs_linux.go was responsible for setting up mounts. Its logic was path-based and racy, creating the opportunity for an attacker to replace a directory with a symlink pointing into /proc between the path resolution/creation step and the actual mount operation. This is the foundational part of the exploit that allows the write gadgets to be aimed at sensitive procfs files.
Unsafe Procfs Reads: Functions like Stat in libcontainer/system/proc.go and setupUser in libcontainer/init_linux.go performed reads from procfs using constructed paths. While the immediate impact of redirecting a read is lower than a write, the patches systematically replaced all such unsafe path-based accesses with secure, file-descriptor-based operations to eliminate the entire class of vulnerability.
The patches introduce safe, handle-based APIs (pathrs.ProcSelfOpen, pathrs.Reopen, etc.) and apply them to all identified vulnerable locations, ensuring that once a file handle is opened, subsequent operations are immune to symlink-based redirection attacks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/opencontainers/runc | go | <= 1.2.7 | 1.2.8 |
| github.com/opencontainers/selinux | go | <= 1.12.0 | |
| github.com/opencontainers/runc | go | >= 1.3.0-rc.1, <= 1.3.2 | 1.3.3 |
| github.com/opencontainers/runc | go | >= 1.4.0-rc.1, <= 1.4.0-rc.2 | 1.4.0-rc.3 |
