Description
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
containers crun
Default version status: unaffected
0 to ≤ 1.29.1affected
Red Hat Red Hat Hardened Images
Default version status: affected
1.30-1.hum1 to < *unaffected
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected