CVE-2026-111434: Medium severity vulnerability
Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/ociload.c.
This issue affects iSulad: through 2.1.6.
When the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes.
Event History
Frequently Asked Questions
Who can realistically trigger this issue?
Exploitation requires local access and high privileges, as reflected by the PR:H vector. The attacker must be able to influence stderr output from the isula runtime shim during container lifecycle operations.
Which operations expose the vulnerable code path?
The affected path is used when the iSulad daemon handles container lifecycle operations through the isula runtime shim, including create, start, exec, and stop operations. The daemon reads the shim's stderr through a pipe to display error information.
Are default deployments known to be affected?
The provided information identifies affected iSulad versions through 2.1.6, but does not state whether the vulnerable isula runtime shim path is enabled or reachable in a default deployment.
How can an administrator determine whether their installation is affected?
Check whether the system runs iSulad version 2.1.6 or earlier and uses the isula runtime shim for container lifecycle operations. The relevant source file is src/daemon/modules/image/oci/oci_load.c.
What mitigation is available if patching cannot happen immediately?
No specific workaround is provided. Limit high-privilege local access and restrict who can control containers or otherwise influence shim stderr output during lifecycle operations.