Description (CNA)
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0 before 1.34.14; affected 1.35.0 before 1.35.9; affected 1.36.0 before 1.36.6; affected 1.37.0 before 1.37.1 |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
CWE
CWE-59
References
- https://access.redhat.com/security/cve/CVE-2026-76061
- https://bugzilla.redhat.com/show_bug.cgi?id=2520330
- https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70
- https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40
- https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b
ADP enrichment
No English description supplied.
No references supplied.