Summary

If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.

Details

For security reasons, container creation should be prohibited if /proc or /sys in the rootfs is a symbolic link.
I verified this behavior with youki.
When /proc or /sys is a symbolic link, runc fails to create the container, whereas youki successfully creates it.

This is the fix related to this issue in runc.

• opencontainers/runc#3756
• opencontainers/runc#3773
• https://github.com/opencontainers/runc/blob/main/libcontainer/rootfs_linux.go#L590
• https://github.com/opencontainers/runc/blob/main/tests/integration/mask.bats#L60

Impact

The following advisory appears to be related to this vulnerability:

• GHSA-vpvm-3wq2-2wvm
• GHSA-fh74-hm69-rqjw