Skip to content
OpenAdvisories
High RLSA-2021:2370 1 CVE

Important: container-tools:3.0 security update

Published Jun 10, 2021 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* runc: vulnerable to symlink exchange attack (CVE-2021-30465)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 41

ReleasePackageFixed in
Rocky Linux · 8 buildah 0:1.19.7-1.module+el8.4.0+558+7340b765
Rocky Linux · 8 cockpit-podman 0:29-2.module+el8.7.0+1076+9b1c11c1
Rocky Linux · 8 cockpit-podman 0:29-2.module+el8.4.0+556+40122d08
Rocky Linux · 8 cockpit-podman 0:29-2.module+el8.5.0+709+440d5e7e
Rocky Linux · 8 cockpit-podman 0:29-2.module+el8.6.0+783+10209741
Rocky Linux · 8 conmon 2:2.0.26-1.module+el8.4.0+558+7340b765
Rocky Linux · 8 conmon 2:2.0.26-1.module+el8.5.0+709+440d5e7e
Rocky Linux · 8 conmon 2:2.0.26-1.module+el8.6.0+783+10209741
Rocky Linux · 8 container-selinux 2:2.158.0-1.module+el8.4.0+558+7340b765
Rocky Linux · 8 containernetworking-plugins 0:0.9.1-1.module+el8.7.0+1076+9b1c11c1
Rocky Linux · 8 containernetworking-plugins 0:0.9.1-1.module+el8.4.0+556+40122d08
Rocky Linux · 8 containernetworking-plugins 0:0.9.1-1.module+el8.5.0+709+440d5e7e
Rocky Linux · 8 containernetworking-plugins 0:0.9.1-1.module+el8.6.0+783+10209741
Rocky Linux · 8 criu 0:3.15-1.module+el8.4.0+556+40122d08
Rocky Linux · 8 criu 0:3.15-1.module+el8.7.0+1076+9b1c11c1
Rocky Linux · 8 criu 0:3.15-1.module+el8.5.0+709+440d5e7e
Rocky Linux · 8 criu 0:3.15-1.module+el8.6.0+783+10209741
Rocky Linux · 8 crun 0:0.18-2.module+el8.4.0+556+40122d08
Rocky Linux · 8 crun 0:0.18-2.module+el8.5.0+709+440d5e7e
Rocky Linux · 8 fuse-overlayfs 0:1.4.0-2.module+el8.7.0+1076+9b1c11c1
Rocky Linux · 8 fuse-overlayfs 0:1.4.0-2.module+el8.4.0+558+7340b765
Rocky Linux · 8 fuse-overlayfs 0:1.4.0-2.module+el8.5.0+709+440d5e7e
Rocky Linux · 8 fuse-overlayfs 0:1.4.0-2.module+el8.6.0+783+10209741
Rocky Linux · 8 libslirp 0:4.3.1-1.module+el8.7.0+1076+9b1c11c1
Rocky Linux · 8 libslirp 0:4.3.1-1.module+el8.4.0+556+40122d08
Rocky Linux · 8 libslirp 0:4.3.1-1.module+el8.5.0+709+440d5e7e
Rocky Linux · 8 libslirp 0:4.3.1-1.module+el8.6.0+783+10209741
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.0-1.module+el8.4.0+558+7340b765
Rocky Linux · 8 podman 0:3.0.1-6.module+el8.4.0+558+7340b765
Rocky Linux · 8 podman 0:3.0.1-6.module+el8.5.0+709+440d5e7e
Rocky Linux · 8 runc 0:1.0.0-71.rc92.module+el8.4.0+558+7340b765
Rocky Linux · 8 skopeo 1:1.2.2-7.module+el8.4.0+558+7340b765
Rocky Linux · 8 slirp4netns 0:1.1.8-1.module+el8.7.0+1076+9b1c11c1
Rocky Linux · 8 slirp4netns 0:1.1.8-1.module+el8.4.0+537+38cf4e42
Rocky Linux · 8 slirp4netns 0:1.1.8-1.module+el8.5.0+709+440d5e7e
Rocky Linux · 8 slirp4netns 0:1.1.8-1.module+el8.6.0+783+10209741
Rocky Linux · 8 toolbox 0:0.0.8-1.module+el8.4.0+556+40122d08
Rocky Linux · 8 udica 0:0.2.4-1.module+el8.7.0+1076+9b1c11c1
Rocky Linux · 8 udica 0:0.2.4-1.module+el8.4.0+556+40122d08
Rocky Linux · 8 udica 0:0.2.4-1.module+el8.5.0+709+440d5e7e
Rocky Linux · 8 udica 0:0.2.4-1.module+el8.6.0+783+10209741

Vulnerabilities 1

  • High 7.6
    CVE-2021-30465 EPSS 10%

    mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs

    runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange a…

    buildah runc github.com/opencontainers/runc k3s Debian Ubuntu Azure Linux Alpine Go

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1954736