-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RustRustMiggo AIRoot Cause AnalysisThe vulnerability in youki is a classic Time-of-check to time-of-use (TOCTOU) race condition, allowing for container escape and denial of service. The core of the issue lies in the use of path-based file system operations on sensitive pseudo-filesystems like /proc. An attacker could manipulate path components (e.g., using symlinks) between the time a path was validated and the time it was used for a write or mount operation. This would redirect the operation to an unintended target within /proc, allowing the attacker to modify system state from within the container.
The provided patch addresses this vulnerability comprehensively by refactoring the code to use file-descriptor-based system calls instead of path-based ones for all security-sensitive operations. This is primarily achieved by integrating the pathrs crate, which provides a safe API for interacting with /proc.
The analysis of the patch identified several key functions that were vulnerable:
apparmor::activate_profile: Wrote to /proc/self/attr/apparmor/exec using a raw path, which was vulnerable to a symlink race.process::init::process::sysctl: Wrote to /proc/sys files based on user-configurable kernel parameters, making it vulnerable to path traversal and race conditions.rootfs::mount::Mount::mount_into_container: Performed mounts using paths, which could be hijacked to mount filesystems outside the container's intended root.process::init::process::masked_path: Used a path-based mount of /dev/null that could be tricked by a malicious symlink.The function utils::ensure_procfs was identified as the faulty security check that was used by some of these vulnerable functions and was removed as part of the fix. The patch replaces these vulnerable patterns with secure, file-descriptor-based alternatives, effectively mitigating the race condition vulnerabilities.
apparmor::activate_profilecrates/libcontainer/src/apparmor.rs
process::init::process::sysctlcrates/libcontainer/src/process/init/process.rs
process::init::process::masked_pathcrates/libcontainer/src/process/init/process.rs
rootfs::mount::Mount::mount_into_containercrates/libcontainer/src/rootfs/mount.rs
utils::ensure_procfscrates/libcontainer/src/utils.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| youki | rust | < 0.5.7 | 0.5.7 |
Ongoing coverage of React2Shell