-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RustRustMiggo AIRoot Cause AnalysisThe vulnerability exists in the youki container runtime because it failed to properly validate the container's root filesystem before setting up mounts. Specifically, it did not check if the /proc or /sys paths inside the container's rootfs were symbolic links. An attacker could craft a container image where /proc is a symbolic link to the host's root directory (/). When youki starts the container, it would follow this symlink and mount the container's procfs on the host's root, giving the container access to the host's filesystem.
The patch addresses this by introducing checks in the libcontainer::rootfs::mount::Mount::setup_mount function. Before mounting procfs or sysfs, the code now uses fs::symlink_metadata to check the nature of the destination path. If the path is not a directory (i.e., it's a file or a symbolic link), the container creation process is aborted with an error. A new helper function, libcontainer::rootfs::mount::Mount::check_proc_mount, was also added to provide more granular checks for /proc mounts, ensuring that only legitimate procfs mounts are allowed.
Therefore, the primary vulnerable function is libcontainer::rootfs::mount::Mount::setup_mount as it contained the logic flaw. The function libcontainer::rootfs::mount::Mount::check_proc_mount is a new security control function introduced by the patch.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| youki | rust | < 0.5.5 | 0.5.5 |
Ongoing coverage of React2Shell