runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade skopeoUpgrade netavarkUpgrade toolboxUpgrade aardvark-dnsUpgrade python3-podmanUpgrade podman-testsUpgrade libslirp-develUpgrade libslirpUpgrade conmonUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade buildah-testsUpgrade containers-commonUpgrade buildahUpgrade criu-libsUpgrade critUpgrade podman-catatonitUpgrade criuUpgrade podman-pluginsUpgrade podman-dockerUpgrade podman-remoteUpgrade python3-criuUpgrade podmanUpgrade container-selinuxUpgrade criu-develUpgrade skopeo-testsUpgrade crunUpgrade runcUpgrade toolbox-testsUpgrade udicaUpgrade containernetworking-plugins | Nov 15, 2022 | May 17, 2022 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | May 17, 2022 |
| Amazon Linux Ami 2 | — | Upgrade runc-debuginfoUpgrade runc | Apr 25, 2025 | May 17, 2022 |
| Amazon_linux_2023 | — | Upgrade runcUpgrade runc-debuginfoUpgrade runc-debugsource | Feb 17, 2025 | May 13, 2022 |
| Centos_linux | — | Upgrade libslirp-debuginfoUpgrade buildah-testsUpgrade podman-gvproxy-debuginfoUpgrade buildah-debuginfoUpgrade buildahUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade criu-libs-debuginfoUpgrade toolbox-debuginfoUpgrade criu-debugsourceUpgrade runc-debugsourceUpgrade runcUpgrade fuse-overlayfs-debugsourceUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade toolbox-debugsourceUpgrade container-selinuxUpgrade skopeo-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade critUpgrade cockpit-podmanUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-remoteUpgrade criu-libsUpgrade criuUpgrade podman-catatonit-debuginfoUpgrade podman-catatonitUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade conmonUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade crunUpgrade podman-gvproxyUpgrade libslirp-develUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade python3-podmanUpgrade containernetworking-plugins-debugsourceUpgrade netavarkUpgrade podman-pluginsUpgrade runc-debuginfoUpgrade libslirpUpgrade conmon-debugsourceUpgrade podman-remote-debuginfoUpgrade crun-debuginfoUpgrade toolboxUpgrade skopeoUpgrade slirp4netnsUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-debuginfoUpgrade libslirp-debugsourceUpgrade udicaUpgrade skopeo-testsUpgrade podman | Nov 9, 2022 | May 17, 2022 |
| Debian | — | Upgrade runc | Mar 29, 2023 | May 17, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | May 17, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-engine | Aug 18, 2022 | May 17, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Nov 4, 2022 | May 17, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade docker-runc | Sep 14, 2022 | May 17, 2022 |
| Oracle_linux | — | Upgrade udicaUpgrade containernetworking-pluginsUpgrade podmanUpgrade runcUpgrade criu-libsUpgrade libslirp-develUpgrade criuUpgrade critUpgrade container-selinuxUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade buildah-testsUpgrade buildahUpgrade podman-remoteUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade libslirpUpgrade netavarkUpgrade podman-testsUpgrade python3-podmanUpgrade crunUpgrade fuse-overlayfsUpgrade criu-develUpgrade podman-pluginsUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade skopeoUpgrade podman-dockerUpgrade conmonUpgrade cockpit-podmanUpgrade slirp4netns | Nov 16, 2022 | May 13, 2022 |
| Redhat Openshift | — | Upgrade runc | Aug 11, 2022 | May 13, 2022 |
| Redhat_linux | — | Upgrade containernetworking-plugins-debuginfoUpgrade libslirp-develUpgrade netavarkUpgrade criu-develUpgrade skopeo-testsUpgrade runc-debugsourceUpgrade criu-libsUpgrade aardvark-dnsUpgrade runc-debuginfoUpgrade buildah-tests-debuginfoUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade criu-debuginfoUpgrade criu-debugsourceUpgrade container-selinuxUpgrade crun-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade podman-debugsourceUpgrade python3-podmanUpgrade toolboxUpgrade podman-remote-debuginfoUpgrade crun-debuginfoUpgrade podman-pluginsUpgrade podmanUpgrade podman-remoteUpgrade conmonUpgrade critUpgrade slirp4netnsUpgrade buildahUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade skopeoUpgrade podman-gvproxyUpgrade python3-criuUpgrade fuse-overlayfsUpgrade skopeo-debuginfoUpgrade crunUpgrade toolbox-testsUpgrade conmon-debuginfoUpgrade libslirpUpgrade conmon-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podman-debuginfoUpgrade cockpit-podmanUpgrade skopeo-debugsourceUpgrade toolbox-debuginfoUpgrade podman-testsNo solution existsUpgrade containernetworking-pluginsUpgrade toolbox-debugsourceUpgrade buildah-testsUpgrade libslirp-debuginfoUpgrade udicaUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade runcUpgrade libslirp-debugsourceUpgrade buildah-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podman-dockerUpgrade podman-catatonitUpgrade criu | Nov 9, 2022 | May 17, 2022 |
| Rocky_linux | — | Upgrade toolbox-testsUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3-criuUpgrade toolbox-debugsourceUpgrade containernetworking-pluginsUpgrade criu-debugsourceUpgrade conmon-debuginfoUpgrade criuUpgrade crun-debugsourceUpgrade podmanUpgrade slirp4netns-debuginfoUpgrade critUpgrade podman-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade aardvark-dnsUpgrade buildah-testsUpgrade runcUpgrade podman-remote-debuginfoUpgrade toolbox-debuginfoUpgrade slirp4netns-debugsourceUpgrade runc-debugsourceUpgrade podman-debugsourceUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debuginfoUpgrade criu-develUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-catatonitUpgrade containernetworking-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade skopeo-debugsourceUpgrade libslirp-develUpgrade skopeo-debuginfoUpgrade podman-testsUpgrade podman-pluginsUpgrade libslirpUpgrade conmon-debugsourceUpgrade buildahUpgrade skopeoUpgrade slirp4netnsUpgrade containers-commonUpgrade fuse-overlayfs-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-gvproxyUpgrade buildah-debugsourceUpgrade crunUpgrade crun-debuginfoUpgrade criu-libsUpgrade fuse-overlayfsUpgrade toolboxUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade criu-debuginfoUpgrade conmonUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonit-debuginfo | Mar 12, 2024 | May 17, 2022 |
| Suse | — | Upgrade docker-zsh-completionUpgrade docker-kubic-zsh-completionUpgrade kubevirt-virt-apiUpgrade docker-kubic-bash-completionUpgrade kubevirt-virt-handlerUpgrade containerd-ctrUpgrade kubevirt-virt-launcherUpgrade kubevirt-manifestsUpgrade docker-kubic-kubeadm-criconfigUpgrade obs-service-kubevirt_containers_metaUpgrade docker-bash-completionUpgrade kubevirt-container-diskUpgrade kubevirt-virt-operatorUpgrade docker-kubic-fish-completionUpgrade kubevirt-virtctlUpgrade docker-fish-completionUpgrade docker-kubicUpgrade dockerUpgrade containerdUpgrade kubevirt-virt-controllerUpgrade kubevirt-testsUpgrade runc | Oct 26, 2022 | May 17, 2022 |
| Ubuntu | — | Upgrade runc (Ubuntu Pro) | May 24, 2023 | May 17, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 17, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub