# Container escape via symlink and mount races

Host-side file operations on container-controlled paths that follow symlinks or re-resolve paths after checks

_Area: Cloud and container security. Seen in 6 disclosed reports; 3 confirmed bounties, median $2,000, range $1,337-$2,000; latest 2025-02-11. Updated 2026-10-23._

## How it works
A privileged host-side component (runtime hook, build daemon, log copier, artifact viewer) touches a path that the container controls. The code assumes that path is a plain file or stays inside the container root. Two assumptions break: (1) the path is a symlink, and the host resolves it against the host filesystem; (2) the path was checked once but is re-walked later while the container filesystem is still mutable, so a swap between check and use (TOCTOU) redirects it. Either way the host reads or writes outside the container root.

## Where it shows up
- Prestart/OCI hooks doing host-side mounts before isolation is applied [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-deep-dive-cve-2024-0132.md)
- Mount loops that resolve paths at init but re-walk them during the loop [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-deep-dive-cve-2024-0132.md)
- Host copies of container output (logs, artifacts) without checking regular-file type [E4](https://bugbountylibrary.com/r/h1%3A694181.md)
- Post-build viewers serving files from a directory the job can write [E2](https://bugbountylibrary.com/r/h1%3A697055.md)
- Ignored-but-retained config filenames an attacker can replace with a symlink [E2](https://bugbountylibrary.com/r/h1%3A697055.md)
- Inherited file descriptors surviving into the child; WORKDIR via /proc/self/fd/N [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-leaky-vessels-container-escape-vulnerabilities.md)
- Build cache-mount subpath handling and mountpoint cleanup traversal [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-leaky-vessels-container-escape-vulnerabilities.md)

## How to review
The invariant: every host-side operation on a container-controlled path must resolve it with no symlink following (O_NOFOLLOW, openat with a dirfd, realpath containment check) and must operate on the same resolved object it validated, with no re-resolution. Check that the path is confirmed to be a regular file and inside the expected root immediately before use, and that the container filesystem cannot change between check and use (lock, copy first, or operate on an fd). For fds, confirm none leak into the child and that cwd/chroot cannot be reached via /proc/self/fd.

## Variants seen
- Symlink planted as mount destination swapped into a later source path [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-deep-dive-cve-2024-0132.md)
- Symlinked ignored config file read by post-build viewer [E2](https://bugbountylibrary.com/r/h1%3A697055.md)
- Leaked fd plus /proc/self/fd WORKDIR escaping rootfs; build cache races [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-leaky-vessels-container-escape-vulnerabilities.md)
- build.log replaced with symlink, host copy follows it [E4](https://bugbountylibrary.com/r/h1%3A694181.md)

## Impact and severity
Host filesystem read and write, host root mount, and full container escape [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-deep-dive-cve-2024-0132.md)[E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-leaky-vessels-container-escape-vulnerabilities.md)[E4](https://bugbountylibrary.com/r/h1%3A694181.md). Severity is critical when the host root is reachable; reading host files like /etc/passwd is high [E2](https://bugbountylibrary.com/r/h1%3A697055.md)[E4](https://bugbountylibrary.com/r/h1%3A694181.md). Worse when the hook or copier runs as root before isolation, and when the attacker controls the image or build inputs.

## Why fixes fail
Fixes that only block one filename or one path miss the general pattern: the same host-side copy or mount logic remains symlink-following for other paths [E2](https://bugbountylibrary.com/r/h1%3A697055.md)[E4](https://bugbountylibrary.com/r/h1%3A694181.md). Patching one runtime leaves sibling components (runC vs BuildKit) exposed [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-leaky-vessels-container-escape-vulnerabilities.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-deep-dive-cve-2024-0132.md
- E2: https://bugbountylibrary.com/r/h1%3A697055.md
- E3: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-leaky-vessels-container-escape-vulnerabilities.md
- E4: https://bugbountylibrary.com/r/h1%3A694181.md