csaf_microsoft - msrc_cve-2024-45310

msrc_cve-2024-45310

Vulnerability from csaf_microsoft

Published

2024-09-01 07:00

Modified

2025-08-06 00:00

Summary

runc can be confused to create empty files/directories on the host

Notes

Additional Resources

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer

The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-45310 runc can be confused to create empty files/directories on the host - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-45310.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "runc can be confused to create empty files/directories on the host",
    "tracking": {
      "current_release_date": "2025-08-06T00:00:00.000Z",
      "generator": {
        "date": "2025-10-20T02:08:32.474Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-45310",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-01-10T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2025-02-11T00:00:00.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2025-04-05T00:00:00.000Z",
          "legacy_version": "3",
          "number": "3",
          "summary": "Information published."
        },
        {
          "date": "2025-08-06T00:00:00.000Z",
          "legacy_version": "4",
          "number": "4",
          "summary": "Added kata-containers to Azure Linux 3.0\nAdded cri-tools to Azure Linux 3.0\nAdded runc to Azure Linux 3.0\nAdded moby-runc to CBL-Mariner 2.0"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              },
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 runc 1.2.2-1",
                "product": {
                  "name": "\u003cazl3 runc 1.2.2-1",
                  "product_id": "19"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 runc 1.2.2-1",
                "product": {
                  "name": "azl3 runc 1.2.2-1",
                  "product_id": "17640"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 runc 1.1.12-2",
                "product": {
                  "name": "\u003cazl3 runc 1.1.12-2",
                  "product_id": "10"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 runc 1.1.12-2",
                "product": {
                  "name": "azl3 runc 1.1.12-2",
                  "product_id": "19725"
                }
              }
            ],
            "category": "product_name",
            "name": "runc"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 moby-runc 1.1.9-8",
                "product": {
                  "name": "\u003ccbl2 moby-runc 1.1.9-8",
                  "product_id": "6"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 moby-runc 1.1.9-8",
                "product": {
                  "name": "cbl2 moby-runc 1.1.9-8",
                  "product_id": "19772"
                }
              }
            ],
            "category": "product_name",
            "name": "moby-runc"
          },
          {
            "category": "product_name",
            "name": "azl3 kubernetes 1.30.10-7",
            "product": {
              "name": "azl3 kubernetes 1.30.10-7",
              "product_id": "15"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 kata-containers-cc 3.15.0.aks0-1",
            "product": {
              "name": "azl3 kata-containers-cc 3.15.0.aks0-1",
              "product_id": "11"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 moby-engine 25.0.3-13",
            "product": {
              "name": "azl3 moby-engine 25.0.3-13",
              "product_id": "9"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 cri-tools 1.30.1-1",
            "product": {
              "name": "azl3 cri-tools 1.30.1-1",
              "product_id": "17"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 cri-tools 1.29.0-6",
            "product": {
              "name": "cbl2 cri-tools 1.29.0-6",
              "product_id": "8"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 cri-o 1.22.3-14",
            "product": {
              "name": "cbl2 cri-o 1.22.3-14",
              "product_id": "5"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 kubevirt 0.59.0-28",
            "product": {
              "name": "cbl2 kubevirt 0.59.0-28",
              "product_id": "4"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 moby-engine 24.0.9-17",
            "product": {
              "name": "cbl2 moby-engine 24.0.9-17",
              "product_id": "3"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 kata-containers 3.15.0.aks0-1",
            "product": {
              "name": "azl3 kata-containers 3.15.0.aks0-1",
              "product_id": "12"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 libcontainers-common 20240213-3",
            "product": {
              "name": "azl3 libcontainers-common 20240213-3",
              "product_id": "18"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 kubevirt 1.2.0-17",
            "product": {
              "name": "azl3 kubevirt 1.2.0-17",
              "product_id": "16"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 kata-containers-cc 3.2.0.azl2-6",
            "product": {
              "name": "cbl2 kata-containers-cc 3.2.0.azl2-6",
              "product_id": "13"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 kata-containers 3.2.0.azl2-6",
            "product": {
              "name": "cbl2 kata-containers 3.2.0.azl2-6",
              "product_id": "14"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 libcontainers-common 20210626-7",
            "product": {
              "name": "cbl2 libcontainers-common 20210626-7",
              "product_id": "2"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 runc 1.2.2-1 as a component of Azure Linux 3.0",
          "product_id": "17084-19"
        },
        "product_reference": "19",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 runc 1.2.2-1 as a component of Azure Linux 3.0",
          "product_id": "17640-17084"
        },
        "product_reference": "17640",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kubernetes 1.30.10-7 as a component of Azure Linux 3.0",
          "product_id": "17084-15"
        },
        "product_reference": "15",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kata-containers-cc 3.15.0.aks0-1 as a component of Azure Linux 3.0",
          "product_id": "17084-11"
        },
        "product_reference": "11",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 runc 1.1.12-2 as a component of Azure Linux 3.0",
          "product_id": "17084-10"
        },
        "product_reference": "10",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 runc 1.1.12-2 as a component of Azure Linux 3.0",
          "product_id": "19725-17084"
        },
        "product_reference": "19725",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 moby-engine 25.0.3-13 as a component of Azure Linux 3.0",
          "product_id": "17084-9"
        },
        "product_reference": "9",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 cri-tools 1.30.1-1 as a component of Azure Linux 3.0",
          "product_id": "17084-17"
        },
        "product_reference": "17",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 cri-tools 1.29.0-6 as a component of CBL Mariner 2.0",
          "product_id": "17086-8"
        },
        "product_reference": "8",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 cri-o 1.22.3-14 as a component of CBL Mariner 2.0",
          "product_id": "17086-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 kubevirt 0.59.0-28 as a component of CBL Mariner 2.0",
          "product_id": "17086-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 moby-engine 24.0.9-17 as a component of CBL Mariner 2.0",
          "product_id": "17086-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kata-containers 3.15.0.aks0-1 as a component of Azure Linux 3.0",
          "product_id": "17084-12"
        },
        "product_reference": "12",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 libcontainers-common 20240213-3 as a component of Azure Linux 3.0",
          "product_id": "17084-18"
        },
        "product_reference": "18",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kubevirt 1.2.0-17 as a component of Azure Linux 3.0",
          "product_id": "17084-16"
        },
        "product_reference": "16",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 kata-containers-cc 3.2.0.azl2-6 as a component of CBL Mariner 2.0",
          "product_id": "17086-13"
        },
        "product_reference": "13",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 kata-containers 3.2.0.azl2-6 as a component of CBL Mariner 2.0",
          "product_id": "17086-14"
        },
        "product_reference": "14",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 moby-runc 1.1.9-8 as a component of CBL Mariner 2.0",
          "product_id": "17086-6"
        },
        "product_reference": "6",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 moby-runc 1.1.9-8 as a component of CBL Mariner 2.0",
          "product_id": "19772-17086"
        },
        "product_reference": "19772",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 libcontainers-common 20210626-7 as a component of CBL Mariner 2.0",
          "product_id": "17086-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17086"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45310",
      "cwe": {
        "id": "CWE-363",
        "name": "Race Condition Enabling Link Following"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17084-15",
            "17084-11",
            "17084-9",
            "17084-17",
            "17086-8",
            "17086-5",
            "17086-4",
            "17086-3",
            "17084-12",
            "17084-16",
            "17086-13",
            "17086-14"
          ]
        },
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "17084-18",
            "17086-2"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "17640-17084",
          "19725-17084",
          "19772-17086"
        ],
        "known_affected": [
          "17084-19",
          "17084-10",
          "17086-6"
        ],
        "known_not_affected": [
          "17084-15",
          "17084-11",
          "17084-9",
          "17084-17",
          "17086-8",
          "17086-5",
          "17086-4",
          "17086-3",
          "17084-12",
          "17084-18",
          "17084-16",
          "17086-13",
          "17086-14",
          "17086-2"
        ],
        "under_investigation": [
          "17086-1",
          "17086-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-45310 runc can be confused to create empty files/directories on the host - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-45310.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-10T00:00:00.000Z",
          "details": "1.2.2-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-19",
            "17084-10"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2025-01-10T00:00:00.000Z",
          "details": "1.1.9-8:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-6"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "environmentalsScore": 0.0,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 3.6,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "17084-19",
            "17084-10",
            "17086-6"
          ]
        }
      ],
      "title": "runc can be confused to create empty files/directories on the host"
    }
  ]
}

CVE-2024-45310 (GCVE-0-2024-45310)

Vulnerability from cvelistv5

Published

2024-09-03 19:07

Modified

2025-02-21 18:03

Severity ?

3.6 (Low) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

CWE

CWE-363 - Race Condition Enabling Link Following
CWE-61 - UNIX Symbolic Link (Symlink) Following

Summary

runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3. Some workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual user on the host (such as with rootless containers that don't use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested.

References

URL

Tags

	https://github.com/opencontainers/runc/security/advisories/GHSA-jfvp-7x6p-h2pv	x_refsource_CONFIRM
	https://github.com/opencontainers/runc/pull/4359	x_refsource_MISC
	https://github.com/opencontainers/runc/commit/63c2908164f3a1daea455bf5bcd8d363d70328c7	x_refsource_MISC
	https://github.com/opencontainers/runc/commit/8781993968fd964ac723ff5f360b6f259e809a3e	x_refsource_MISC
	https://github.com/opencontainers/runc/commit/f0b652ea61ff6750a8fcc69865d45a7abf37accf	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	opencontainers	runc	Version: < 1.1.14 Version: >= 1.2.0-rc-1, < 1.2.0-rc.3

Show details on NVD website