runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-systemd-hookUpgrade oci-umount | May 13, 2022 | Feb 11, 2019 |
| Alpine Linux | — | Upgrade flatpakUpgrade lxcUpgrade runc | Aug 22, 2024 | Feb 11, 2019 |
| Amazon_linux | — | Upgrade docker | Feb 12, 2019 | Feb 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 11, 2019 |
| Centos_linux | — | Upgrade slirp4netns-debuginfoUpgrade docker-commonUpgrade buildah-debugsourceUpgrade podmanUpgrade slirp4netns-debugsourceUpgrade docker-rhel-push-pluginUpgrade docker-lvm-pluginUpgrade podman-debugsourceUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade oci-umountUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade dockerUpgrade containernetworking-plugins-debuginfoUpgrade docker-novolume-pluginUpgrade skopeoUpgrade docker-v1.10-migratorUpgrade runc-debuginfoUpgrade fuse-overlayfsUpgrade skopeo-debugsourceUpgrade podman-dockerUpgrade oci-systemd-hookUpgrade runc-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade podman-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade docker-clientUpgrade buildah-debuginfoUpgrade docker-logrotateUpgrade container-selinuxUpgrade oci-umount-debuginfoUpgrade docker-debuginfoUpgrade runcUpgrade oci-umount-debugsourceUpgrade buildahUpgrade slirp4netnsUpgrade skopeo-debuginfo | Aug 28, 2019 | Feb 11, 2019 |
| Debian | — | Upgrade runcUpgrade lxc | Jul 30, 2024 | Feb 11, 2019 |
| Docker | — | Upgrade to Docker v18.09.2 | Feb 12, 2019 | Feb 12, 2019 |
| Docker_ee | — | Upgrade Docker EE to version 18.09.2 | Nov 25, 2019 | Feb 11, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade docker-engine | Feb 22, 2019 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Mar 11, 2019 | Feb 11, 2019 |
| Oracle_linux | — | Upgrade containers-commonUpgrade runcUpgrade container-selinuxUpgrade buildahUpgrade containernetworking-pluginsUpgrade oci-systemd-hookUpgrade docker-engineUpgrade podmanUpgrade fuse-overlayfsUpgrade skopeoUpgrade oci-umountUpgrade podman-dockerUpgrade slirp4netns | Feb 12, 2019 | Feb 11, 2019 |
| Redhat Openshift | — | Upgrade docker | Feb 27, 2019 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade runcUpgrade podman-dockerNo solution existsUpgrade runc-debugsourceUpgrade podmanUpgrade podman-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netnsUpgrade oci-umountUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade skopeo-debugsourceUpgrade buildahUpgrade buildah-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade skopeo-debuginfoUpgrade containers-commonUpgrade containernetworking-plugins-debuginfoUpgrade oci-systemd-hookUpgrade runc-debuginfoUpgrade oci-umount-debugsourceUpgrade podman-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade slirp4netns-debuginfoUpgrade oci-umount-debuginfoUpgrade container-selinuxUpgrade buildah-debugsource | Feb 12, 2019 | Feb 11, 2019 |
| Rocky_linux | — | Upgrade oci-umount-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade oci-umountUpgrade oci-umount-debugsourceUpgrade oci-systemd-hook | Mar 12, 2024 | Feb 11, 2019 |
| Suse | — | Upgrade flatpak-zsh-completionUpgrade containerd-testUpgrade containerdUpgrade flatpakUpgrade go1.11-docUpgrade go1.12-raceUpgrade typelib-1_0-flatpak-1_0Upgrade lxc-bash-completionUpgrade liblxc1Upgrade docker-runc-testUpgrade lxcfsUpgrade liblxc-develUpgrade dockerUpgrade go1.12-docUpgrade containerd-ctrUpgrade runc-testUpgrade lxcfs-hooks-lxcUpgrade go1.11Upgrade goUpgrade go-docUpgrade golang-github-docker-libnetworkUpgrade docker-bash-completionUpgrade docker-zsh-completionUpgrade runcUpgrade go-raceUpgrade go1.11-raceUpgrade system-user-flatpakUpgrade docker-testUpgrade libflatpak0Upgrade pam_cgfsUpgrade lxcUpgrade flatpak-develUpgrade go1.12Upgrade docker-libnetworkUpgrade docker-runc | Feb 20, 2019 | Feb 11, 2019 |
| Ubuntu | — | Upgrade docker.io | Jul 9, 2019 | Feb 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub