Read the docs
TI-2021-10869 Aliases CVE-2021-30465GHSA-c3xm-pvg7-gh7r

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal.

Priority MEDIUM 49CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

Why it matters now

EPSS 0.10245 95th percentileScored 2026-11-07
Fix Partial github.com/opencontainers/runc (Go): 1.0.0-rc95Red Hat: 11 advisoriesRed Hat: 8 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/opencontainers/runc (Go)before 1.0.0-rc951.0.0-rc95Patch availableGHSA-c3xm-pvg7-gh7r
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/opencontainers/runc (Go) Vendor— Affected before 1.0.0-rc95 Fixed in 1.0.0-rc95 Patch available GHSA-c3xm-pvg7-gh7r

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*up to 0.1.1Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:*1.0.0 rc1Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc10:*:*:*:*:*:*1.0.0 rc10Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:*1.0.0 rc2Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*1.0.0 rc3Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*1.0.0 rc4Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*1.0.0 rc5Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*1.0.0 rc6Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:*1.0.0 rc7Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:*1.0.0 rc8Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions up to 0.1.1 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:* Versions 1.0.0 rc1 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc10:*:*:*:*:*:* Versions 1.0.0 rc10 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:* Versions 1.0.0 rc2 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:* Versions 1.0.0 rc3 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:* Versions 1.0.0 rc4 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:* Versions 1.0.0 rc5 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:* Versions 1.0.0 rc6 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:* Versions 1.0.0 rc7 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:* Versions 1.0.0 rc8 Vulnerable ·backstage
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9:*:*:*:*:*:*1.0.0 rc9Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc90:*:*:*:*:*:*1.0.0 rc90Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc91:*:*:*:*:*:*1.0.0 rc91Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc92:*:*:*:*:*:*1.0.0 rc92Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc93:*:*:*:*:*:*1.0.0 rc93Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc94:*:*:*:*:*:*1.0.0 rc94Vulnerablebackstage
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9:*:*:*:*:*:* Versions 1.0.0 rc9 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc90:*:*:*:*:*:* Versions 1.0.0 rc90 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc91:*:*:*:*:*:* Versions 1.0.0 rc91 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc92:*:*:*:*:*:* Versions 1.0.0 rc92 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc93:*:*:*:*:*:* Versions 1.0.0 rc93 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.0.0:rc94:*:*:*:*:*:* Versions 1.0.0 rc94 Vulnerable ·backstage
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-c3xm-pvg7-gh7r github.com/opencontainers/runc (Go) Fixed in 1.0.0-rc95 Advisory →

Red Hat 11 advisories

  • RHSA-2021:2437 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 packages and security update
    • Red Hat OpenShift Container Platform 4.8 afterburn-5.0.0-1.rhaos4.8.el8, atomic-openshift-service-idler-4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8, butane-0.12.1-1.rhaos4.8.el8 +47
  • RHSA-2021:2370 Released 2021-06-10 · Red Hat rating Important
    container-tools:3.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.19.7-1.module+el8.4.0+11310+8c67a752.aarch64::container-tools:3.0, buildah-1.19.7-1.module+el8.4.0+11310+8c67a752.ppc64le::container-tools:3.0, buildah-1.19.7-1.module+el8.4.0+11310+8c67a752.s390x::container-tools:3.0 +47
  • RHSA-2021:2371 Released 2021-06-10 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.19.7-2.module+el8.4.0+11311+9da8acfb.aarch64::container-tools:rhel8, buildah-1.19.7-2.module+el8.4.0+11311+9da8acfb.ppc64le::container-tools:rhel8, buildah-1.19.7-2.module+el8.4.0+11311+9da8acfb.s390x::container-tools:rhel8 +47
Show 8 more Red Hat advisories
  • RHSA-2021:2150 Released 2021-06-09 · Red Hat rating Important
    OpenShift Container Platform 3.11.452 bug fix and security update
    • Red Hat OpenShift Container Platform 3.11 runc-1.0.0-69.rc10.el7_9
  • RHSA-2021:2291 Released 2021-06-08 · Red Hat rating Important
    container-tools:2.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.11.6-8.module+el8.4.0+10193+e90fd8eb.aarch64::container-tools:2.0, buildah-1.11.6-8.module+el8.4.0+10193+e90fd8eb.ppc64le::container-tools:2.0, buildah-1.11.6-8.module+el8.4.0+10193+e90fd8eb.s390x::container-tools:2.0 +47
  • RHSA-2021:2292 Released 2021-06-08 · Red Hat rating Important
    container-tools:2.0 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) buildah-1.11.6-7.module+el8.2.0+11121+714aca16.aarch64::container-tools:2.0, buildah-1.11.6-7.module+el8.2.0+11121+714aca16.ppc64le::container-tools:2.0, buildah-1.11.6-7.module+el8.2.0+11121+714aca16.s390x::container-tools:2.0 +47
  • RHSA-2021:2145 Released 2021-05-31 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux 7 Extras runc-1.0.0-69.rc10.el7_9
  • RHSA-2021:2144 Released 2021-05-31 · Red Hat rating Important
    docker security update
    • Red Hat Enterprise Linux 7 Extras docker-2:1.13.1-206.git7d71120.el7_9, docker-client-2:1.13.1-206.git7d71120.el7_9, docker-common-2:1.13.1-206.git7d71120.el7_9 +5
  • RHSA-2021:2057 Released 2021-05-26 · Red Hat rating Important
    OpenShift Container Platform 4.5.40 security and bug fix update
    • Red Hat OpenShift Container Platform 4.5 openshift-4.5.0-202105121820.p0.git.d8ef5ad.el7, openshift-4.5.0-202105121820.p0.git.d8ef5ad.el8, openshift-hyperkube-4.5.0-202105121820.p0.git.d8ef5ad.el7 +3
  • RHSA-2021:1566 Released 2021-05-26 · Red Hat rating Important
    OpenShift Container Platform 4.6.30 packages and security update
    • Red Hat OpenShift Container Platform 4.6 openshift-4.6.0-202105150940.p0.git.9caf8fe.el7, openshift-4.6.0-202105150940.p0.git.9caf8fe.el8, openshift-hyperkube-4.6.0-202105150940.p0.git.9caf8fe.el7 +3
  • RHSA-2021:1562 Released 2021-05-24 · Red Hat rating Important
    OpenShift Container Platform 4.7.12 packages and security update
    • Red Hat OpenShift Container Platform 4.7 jenkins-2.277.3.1620985335-1.el8, openshift-4.7.0-202105160013.p0.git.df9c838.el7, openshift-4.7.0-202105160013.p0.git.df9c838.el8 +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7 ExtrasFixed RHSA-2021:2144, RHSA-2021:2145
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:2291, RHSA-2021:2370, RHSA-2021:2371
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2021:2292
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2021:2150
Red Hat OpenShift Container Platform 4.5Fixed RHSA-2021:2057
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:1566
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2021:1562
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2437
Not affected: 4 products
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-30465
  2. 2026-10-03 Alias added: GHSA-c3xm-pvg7-gh7r
  3. 2026-10-18 EPSS moved to the 95th–99th percentile

References

Patch 2

Advisory 7

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences