TOCTOU issue when mounting (running) containers on the host
Affected packages
pve-container
Details
The pct mount and pct fstrim tasks lacked protection against concurrent modifications to the container mountpoint hierarchy by a running container. An attacker with access to a running container could win the race against the incomplete checks, resulting in mounting of attacker-controlled directories over arbitrary host paths, which could be chained into root-level code execution on the host.
This issue was found internally.
Fixed in
- pve-container >= 6.1.15
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.