CVE-2021-43784 (Go, published 2021-12-06T18:15Z)
Description: value: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.
Severity: MEDIUM (CVSS v3 base score: 5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/opencontainers/runc
Files changed:
libcontainer/configs/mount.go
libcontainer/container_linux.go
libcontainer/factory_linux.go
libcontainer/init_linux.go
libcontainer/message_linux.go
libcontainer/nsenter/nsexec.c
libcontainer/rootfs_linux.go
libcontainer/standard_init_linux.go
Commit message: Open bind mount sources from the host userns

The source of the bind mount might not be accessible in a different user
namespace because a component of the source path might not be traversed
under the users and groups mapped inside the user namespace. This caused
errors such as the following:

  # time="2020-06-22T13:48:26Z" level=error msg="container_linux.go:367:
  starting container process caused: process_linux.go:459:
  container init caused: rootfs_linux.go:58:
  mounting \"/tmp/busyboxtest/source-inaccessible/dir\"
  to rootfs at \"/tmp/inaccessible\" caused:
  stat /tmp/busyboxtest/source-inaccessible/dir: permission denied"

To solve this problem, this patch performs the following:

1. in nsexec.c, it opens the source path in the host userns (so we have
   the right permissions to open it) but in the container mntns (so the
   kernel cross mntns mount check let us mount it later:
   https://github.com/torvalds/linux/blob/v5.8/fs/namespace.c#L2312).

2. in nsexec.c, it passes the file descriptors of the source to the
   child process with SCM_RIGHTS.

3. In runc-init in Golang, it finishes the mounts while inside the
   userns even without access to the some components of the source
   paths.

Passing the fds with SCM_RIGHTS is necessary because once the child
process is in the container mntns, it is already in the container userns
so it cannot temporarily join the host mntns.

This patch uses the existing mechanism with _LIBCONTAINER_* environment
variables to pass the file descriptors from runc to runc init.

This patch uses the existing mechanism with the Netlink-style bootstrap
to pass information about the list of source mounts to nsexec.c.

Rootless containers don't use this bind mount sources fdpassing
mechanism because we can't setns() to the target mntns in a rootless
container (we don't have the privileges when we are in the host userns).

This patch takes care of using O_CLOEXEC on mount fds, and close them
early.

Fixes: #2484.

Signed-off-by: Alban Crequy <alban@kinvolk.io>
Signed-off-by: Rodrigo Campos <rodrigo@kinvolk.io>
Co-authored-by: Rodrigo Campos <rodrigo@kinvolk.io>


Vulnerable code:
	data, err := c.bootstrapData(c.config.Namespaces.CloneFlags(), nsMaps)
	data, err := c.bootstrapData(0, state.NamespacePaths)
		if err := prepareBindMount(m, c.config.Rootfs); err != nil {
func (c *linuxContainer) bootstrapData(cloneFlags uintptr, nsMaps map[configs.NamespaceType]string) (io.Reader, error) {
	i, err := newContainerInit(it, pipe, consoleSocket, fifofd, logPipeFd)
func newContainerInit(t initType, pipe *os.File, consoleSocket *os.File, fifoFd, logFd int) (initer, error) {
func prepareRootfs(pipe io.ReadWriter, iConfig *initConfig) (err error) {
	for _, m := range config.Mounts {
func prepareBindMount(m *configs.Mount, rootfs string) error {
	stat, err := os.Stat(m.Source)
	if err := checkProcMount(rootfs, dest, m.Source); err != nil {
	err = mountPropagate(m, "/", mountLabel)
		return mountPropagate(m, rootfs, "")
		if err := mountPropagate(m, rootfs, ""); err != nil {
			err = mountPropagate(m, rootfs, mountLabel)
			if err := remount(m, rootfs); err != nil {
		if err := prepareBindMount(m, rootfs); err != nil {
		if err := mountPropagate(m, rootfs, mountLabel); err != nil {
			if err := remount(m, rootfs); err != nil {
		return mountPropagate(m, rootfs, mountLabel)
func remount(m *configs.Mount, rootfs string) error {
		return mount(m.Source, m.Destination, procfd, m.Device, uintptr(m.Flags|unix.MS_REMOUNT), "")
func mountPropagate(m *configs.Mount, rootfs string, mountLabel string) error {
		return mount(m.Source, m.Destination, procfd, m.Device, uintptr(flags), data)
	if err := prepareRootfs(l.pipe, l.config); err != nil {

Fixed code:
import "golang.org/x/sys/unix"


func (m *Mount) IsBind() bool {
	return m.Flags&unix.MS_BIND != 0
}
// shouldSendMountSources says whether the child process must setup bind mounts with
// the source pre-opened (O_PATH) in the host user namespace.
// See https://github.com/opencontainers/runc/issues/2484
func (c *linuxContainer) shouldSendMountSources() bool {
	// Passing the mount sources via SCM_RIGHTS is only necessary when
	// both userns and mntns are active.
	if !c.config.Namespaces.Contains(configs.NEWUSER) ||
		!c.config.Namespaces.Contains(configs.NEWNS) {
		return false
	}

	// nsexec.c send_mountsources() requires setns(mntns) capabilities
	// CAP_SYS_CHROOT and CAP_SYS_ADMIN.
	if c.config.RootlessEUID {
		return false
	}

	// We need to send sources if there are bind-mounts.
	for _, m := range c.config.Mounts {
		if m.IsBind() {
			return true
		}
	}

	return false
}

	data, err := c.bootstrapData(c.config.Namespaces.CloneFlags(), nsMaps, initStandard)

	if c.shouldSendMountSources() {
		// Elements on this slice will be paired with mounts (see StartInitialization() and
		// prepareRootfs()). This slice MUST have the same size as c.config.Mounts.
		mountFds := make([]int, len(c.config.Mounts))
		for i, m := range c.config.Mounts {
			if !m.IsBind() {
				// Non bind-mounts do not use an fd.
				mountFds[i] = -1
				continue
			}

			// The fd passed here will not be used: nsexec.c will overwrite it with dup3(). We just need
			// to allocate a fd so that we know the number to pass in the environment variable. The fd
			// must not be closed before cmd.Start(), so we reuse messageSockPair.child because the
			// lifecycle of that fd is already taken care of.
			cmd.ExtraFiles = append(cmd.ExtraFiles, messageSockPair.child)
			mountFds[i] = stdioFdCount + len(cmd.ExtraFiles) - 1
		}

		mountFdsJson, err := json.Marshal(mountFds)
		if err != nil {
			return nil, fmt.Errorf("Error creating _LIBCONTAINER_MOUNT_FDS: %w", err)
		}

		cmd.Env = append(cmd.Env,
			"_LIBCONTAINER_MOUNT_FDS="+string(mountFdsJson),
		)
	}

	data, err := c.bootstrapData(0, state.NamespacePaths, initSetns)
		// TODO: pass something else than nil? Not sure if criu is
		// impacted by issue #2484
		if err := prepareBindMount(m, c.config.Rootfs, nil); err != nil {
func (c *linuxContainer) bootstrapData(cloneFlags uintptr, nsMaps map[configs.NamespaceType]string, it initType) (io.Reader, error) {
	// Bind mount source to open.
	if it == initStandard && c.shouldSendMountSources() {
		var mounts []byte
		for _, m := range c.config.Mounts {
			if m.IsBind() {
				mounts = append(mounts, []byte(m.Source)...)
			}
			mounts = append(mounts, byte(0))
		}

		r.AddData(&Bytemsg{
			Type:  MountSourcesAttr,
			Value: mounts,
		})
	}

	// Get mount files (O_PATH).
	mountFds, err := parseMountFds()
	if err != nil {
		return err
	}

	i, err := newContainerInit(it, pipe, consoleSocket, fifofd, logPipeFd, mountFds)

func parseMountFds() ([]int, error) {
	fdsJson := os.Getenv("_LIBCONTAINER_MOUNT_FDS")
	if fdsJson == "" {
		// Always return the nil slice if no fd is present.
		return nil, nil
	}

	var mountFds []int
	if err := json.Unmarshal([]byte(fdsJson), &mountFds); err != nil {
		return nil, fmt.Errorf("Error unmarshalling _LIBCONTAINER_MOUNT_FDS: %w", err)
	}

	return mountFds, nil
}
func newContainerInit(t initType, pipe *os.File, consoleSocket *os.File, fifoFd, logFd int, mountFds []int) (initer, error) {
		// mountFds must be nil in this case. We don't mount while doing runc exec.
		if mountFds != nil {
			return nil, errors.New("mountFds must be nil. Can't mount while doing runc exec.")
		}

			mountFds:      mountFds,
	MountSourcesAttr uint16 = 27290
#include <limits.h>
	SYNC_MOUNTSOURCES_PLS = 0x46,	/* Tell parent to send mount sources by SCM_RIGHTS. */
	SYNC_MOUNTSOURCES_ACK = 0x47,	/* All mount sources have been sent. */

	/* Mount sources opened outside the container userns. */
	char *mountsources;
	size_t mountsources_len;
#define MOUNT_SOURCES_ATTR	27290
		case MOUNT_SOURCES_ATTR:
			config->mountsources = current;
			config->mountsources_len = payload_len;
			break;
void receive_fd(int sockfd, int new_fd)
{
	int bytes_read;
	struct msghdr msg = { };
	struct cmsghdr *cmsg;
	struct iovec iov = { };
	char null_byte = '\0';
	int ret;
	int fd_count;
	int *fd_payload;

	iov.iov_base = &null_byte;
	iov.iov_len = 1;

	msg.msg_iov = &iov;
	msg.msg_iovlen = 1;

	msg.msg_controllen = CMSG_SPACE(sizeof(int));
	msg.msg_control = malloc(msg.msg_controllen);
	if (msg.msg_control == NULL) {
		bail("Can't allocate memory to receive fd.");
	}

	memset(msg.msg_control, 0, msg.msg_controllen);

	bytes_read = recvmsg(sockfd, &msg, 0);
	if (bytes_read != 1)
		bail("failed to receive fd from unix socket %d", sockfd);
	if (msg.msg_flags & MSG_CTRUNC)
		bail("received truncated control message from unix socket %d", sockfd);

	cmsg = CMSG_FIRSTHDR(&msg);
	if (!cmsg)
		bail("received message from unix socket %d without control message", sockfd);

	if (cmsg->cmsg_level != SOL_SOCKET)
		bail("received unknown control message from unix socket %d: cmsg_level=%d", sockfd, cmsg->cmsg_level);

	if (cmsg->cmsg_type != SCM_RIGHTS)
		bail("received unknown control message from unix socket %d: cmsg_type=%d", sockfd, cmsg->cmsg_type);

	fd_count = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
	if (fd_count != 1)
		bail("received control message from unix socket %d with too many fds: %d", sockfd, fd_count);

	fd_payload = (int *)CMSG_DATA(cmsg);
	ret = dup3(*fd_payload, new_fd, O_CLOEXEC);
	if (ret < 0)
		bail("cannot dup3 fd %d to %d", *fd_payload, new_fd);

	free(msg.msg_control);

	ret = close(*fd_payload);
	if (ret < 0)
		bail("cannot close fd %d", *fd_payload);
}

void send_fd(int sockfd, int fd)
{
	int bytes_written;
	struct msghdr msg = { };
	struct cmsghdr *cmsg;
	struct iovec iov[1] = { };
	char null_byte = '\0';

	iov[0].iov_base = &null_byte;
	iov[0].iov_len = 1;

	msg.msg_iov = iov;
	msg.msg_iovlen = 1;

	/* We send only one fd as specified by cmsg->cmsg_len below, even
	 * though msg.msg_controllen might have more space due to alignment. */
	msg.msg_controllen = CMSG_SPACE(sizeof(int));
	msg.msg_control = malloc(msg.msg_controllen);
	if (msg.msg_control == NULL) {
		bail("Can't allocate memory to send fd.");
	}

	memset(msg.msg_control, 0, msg.msg_controllen);

	cmsg = CMSG_FIRSTHDR(&msg);
	cmsg->cmsg_level = SOL_SOCKET;
	cmsg->cmsg_type = SCM_RIGHTS;
	cmsg->cmsg_len = CMSG_LEN(sizeof(int));
	memcpy(CMSG_DATA(cmsg), &fd, sizeof(int));

	bytes_written = sendmsg(sockfd, &msg, 0);

	free(msg.msg_control);

	if (bytes_written != 1)
		bail("failed to send fd %d via unix socket %d", fd, sockfd);
}

void receive_mountsources(int sockfd)
{
	char *mount_fds, *endp;
	long new_fd;

	// This env var must be a json array of ints.
	mount_fds = getenv("_LIBCONTAINER_MOUNT_FDS");

	if (mount_fds[0] != '[') {
		bail("malformed _LIBCONTAINER_MOUNT_FDS env var: missing '['");
	}
	mount_fds++;

	for (endp = mount_fds; *endp != ']'; mount_fds = endp + 1) {
		new_fd = strtol(mount_fds, &endp, 10);
		if (endp == mount_fds) {
			bail("malformed _LIBCONTAINER_MOUNT_FDS env var: not a number");
		}
		if (*endp == '\0') {
			bail("malformed _LIBCONTAINER_MOUNT_FDS env var: missing ]");
		}
		// The list contains -1 when no fd is needed. Ignore them.
		if (new_fd == -1) {
			continue;
		}

		if (new_fd == LONG_MAX || new_fd < 0 || new_fd > INT_MAX) {
			bail("malformed _LIBCONTAINER_MOUNT_FDS env var: fds out of range");
		}

		receive_fd(sockfd, new_fd);
	}
}

void send_mountsources(int sockfd, pid_t child, char *mountsources, size_t mountsources_len)
{
	char proc_path[PATH_MAX];
	int host_mntns_fd;
	int container_mntns_fd;
	int fd;
	int ret;

	// container_linux.go shouldSendMountSources() decides if mount sources
	// should be pre-opened (O_PATH) and passed via SCM_RIGHTS
	if (mountsources == NULL)
		return;

	host_mntns_fd = open("/proc/self/ns/mnt", O_RDONLY | O_CLOEXEC);
	if (host_mntns_fd == -1)
		bail("failed to get current mount namespace");

	if (snprintf(proc_path, PATH_MAX, "/proc/%d/ns/mnt", child) < 0)
		bail("failed to get mount namespace path");

	container_mntns_fd = open(proc_path, O_RDONLY | O_CLOEXEC);
	if (container_mntns_fd == -1)
		bail("failed to get container mount namespace");

	if (setns(container_mntns_fd, CLONE_NEWNS) < 0)
		bail("failed to setns to container mntns");

	char *mountsources_end = mountsources + mountsources_len;
	while (mountsources < mountsources_end) {
		if (mountsources[0] == '\0') {
			mountsources++;
			continue;
		}

		fd = open(mountsources, O_PATH | O_CLOEXEC);
		if (fd < 0)
			bail("failed to open mount source %s", mountsources);

		send_fd(sockfd, fd);

		ret = close(fd);
		if (ret != 0)
			bail("failed to close mount source fd %d", fd);

		mountsources += strlen(mountsources) + 1;
	}

	if (setns(host_mntns_fd, CLONE_NEWNS) < 0)
		bail("failed to setns to host mntns");

	ret = close(host_mntns_fd);
	if (ret != 0)
		bail("failed to close host mount namespace fd %d", host_mntns_fd);
	ret = close(container_mntns_fd);
	if (ret != 0)
		bail("failed to close container mount namespace fd %d", container_mntns_fd);
}

				case SYNC_MOUNTSOURCES_PLS:
					send_mountsources(syncfd, stage1_pid, config.mountsources,
							  config.mountsources_len);

					s = SYNC_MOUNTSOURCES_ACK;
					if (write(syncfd, &s, sizeof(s)) != sizeof(s)) {
						kill(stage1_pid, SIGKILL);
						bail("failed to sync with child: write(SYNC_MOUNTSOURCES_ACK)");
					}
					break;
			/* Ask our parent to send the mount sources fds. */
			if (config.mountsources) {
				s = SYNC_MOUNTSOURCES_PLS;
				if (write(syncfd, &s, sizeof(s)) != sizeof(s)) {
					kill(stage2_pid, SIGKILL);
					bail("failed to sync with parent: write(SYNC_MOUNTSOURCES_PLS)");
				}

				/* Receive and install all mount sources fds. */
				receive_mountsources(syncfd);

				/* Parent finished to send the mount sources fds. */
				if (read(syncfd, &s, sizeof(s)) != sizeof(s)) {
					kill(stage2_pid, SIGKILL);
					bail("failed to sync with parent: read(SYNC_MOUNTSOURCES_ACK)");
				}
				if (s != SYNC_MOUNTSOURCES_ACK) {
					kill(stage2_pid, SIGKILL);
					bail("failed to sync with parent: SYNC_MOUNTSOURCES_ACK: got %u", s);
				}
			}

	fd              *int
func prepareRootfs(pipe io.ReadWriter, iConfig *initConfig, mountFds []int) (err error) {
	if mountFds != nil && len(mountFds) != len(config.Mounts) {
		return fmt.Errorf("malformed mountFds slice. Expected size: %v, got: %v. Slice: %v", len(config.Mounts), len(mountFds), mountFds)
	}

	for i, m := range config.Mounts {

		// Just before the loop we checked that if not empty, len(mountFds) == len(config.Mounts).
		// Therefore, we can access mountFds[i] without any concerns.
		if mountFds != nil && mountFds[i] != -1 {
			mountConfig.fd = &mountFds[i]
		}

func prepareBindMount(m *configs.Mount, rootfs string, mountFd *int) error {
	source := m.Source
	if mountFd != nil {
		source = "/proc/self/fd/" + strconv.Itoa(*mountFd)
	}

	stat, err := os.Stat(source)
	if err := checkProcMount(rootfs, dest, source); err != nil {


	err = mountPropagate(m, "/", mountLabel, nil)
	mountFd := c.fd
		return mountPropagate(m, rootfs, "", nil)
		if err := mountPropagate(m, rootfs, "", nil); err != nil {
			err = mountPropagate(m, rootfs, mountLabel, nil)


			if err := remount(m, rootfs, mountFd); err != nil {
		if err := prepareBindMount(m, rootfs, mountFd); err != nil {
		if err := mountPropagate(m, rootfs, mountLabel, mountFd); err != nil {
			if err := remount(m, rootfs, mountFd); err != nil {
		return mountPropagate(m, rootfs, mountLabel, mountFd)
func remount(m *configs.Mount, rootfs string, mountFd *int) error {
	source := m.Source
	if mountFd != nil {
		source = "/proc/self/fd/" + strconv.Itoa(*mountFd)
	}

		return mount(source, m.Destination, procfd, m.Device, uintptr(m.Flags|unix.MS_REMOUNT), "")
func mountPropagate(m *configs.Mount, rootfs string, mountLabel string, mountFd *int) error {
	source := m.Source
	if mountFd != nil {
		source = "/proc/self/fd/" + strconv.Itoa(*mountFd)
	}

		return mount(source, m.Destination, procfd, m.Device, uintptr(flags), data)
	mountFds      []int

	// We don't need the mountFds after prepareRootfs() nor if it fails.
	err := prepareRootfs(l.pipe, l.config, l.mountFds)
	for _, m := range l.mountFds {
		if m == -1 {
			continue
		}

		if err := unix.Close(m); err != nil {
			return fmt.Errorf("Unable to close mountFds fds: %w", err)
		}
	}

	if err != nil {