runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade skopeoUpgrade podman-catatonitUpgrade criuUpgrade containers-commonUpgrade criu-libsUpgrade fuse-overlayfsUpgrade crunUpgrade oci-seccomp-bpf-hookUpgrade podmanUpgrade libslirp-develUpgrade python3-podmanUpgrade conmonUpgrade criu-develUpgrade containernetworking-pluginsUpgrade toolboxUpgrade netavarkUpgrade skopeo-testsUpgrade podman-pluginsUpgrade python3-criuUpgrade cockpit-podmanUpgrade buildah-testsUpgrade runcUpgrade buildahUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade podman-testsUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade libslirpUpgrade podman-remoteUpgrade container-selinuxUpgrade critUpgrade udicaUpgrade podman-docker | Nov 16, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | Mar 3, 2023 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Jun 7, 2023 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade runc-debugsourceUpgrade runc-debuginfoUpgrade runc | Feb 17, 2025 | Feb 20, 2023 |
| Centos_linux | — | Upgrade containernetworking-plugins-debuginfoUpgrade slirp4netnsUpgrade buildahUpgrade cockpit-podmanUpgrade skopeo-debugsourceUpgrade crunUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade toolbox-debuginfoUpgrade critUpgrade podman-catatonitUpgrade containernetworking-plugins-debugsourceUpgrade criu-libs-debuginfoUpgrade libslirp-debugsourceUpgrade buildah-testsUpgrade udicaUpgrade toolbox-debugsourceUpgrade libslirp-debuginfoUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade toolbox-testsUpgrade skopeo-debuginfoUpgrade podman-dockerUpgrade podman-remoteUpgrade skopeoUpgrade podman-gvproxyUpgrade podmanUpgrade fuse-overlayfs-debuginfoUpgrade container-selinuxUpgrade podman-testsUpgrade criuUpgrade containernetworking-pluginsUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade containers-commonUpgrade criu-develUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade conmon-debugsourceUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade python3-podmanUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade netavarkUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade buildah-debuginfoUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade skopeo-testsUpgrade buildah-tests-debuginfoUpgrade conmonUpgrade criu-libsUpgrade toolboxUpgrade runc-debugsource | Nov 8, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade runc | Mar 29, 2023 | Mar 3, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | May 9, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Jan 10, 2024 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade udicaUpgrade podman-dockerUpgrade skopeo-testsUpgrade slirp4netnsUpgrade container-selinuxUpgrade podman-gvproxyUpgrade critUpgrade crunUpgrade podman-pluginsUpgrade podman-testsUpgrade podman-remoteUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade criu-develUpgrade runcUpgrade netavarkUpgrade python3-podmanUpgrade cockpit-podmanUpgrade libslirpUpgrade criuUpgrade libslirp-develUpgrade podmanUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade containers-commonUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade aardvark-dnsUpgrade skopeoUpgrade podman-catatonitUpgrade conmon | Jul 20, 2023 | Feb 20, 2023 |
| Redhat Openshift | — | Upgrade runc | Jun 26, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade podman-plugins-debuginfoUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxyUpgrade conmon-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-testsUpgrade slirp4netnsUpgrade slirp4netns-debuginfoUpgrade buildah-testsUpgrade libslirp-debugsourceUpgrade podman-dockerUpgrade runc-debugsourceUpgrade runc-debuginfoUpgrade python3-criuUpgrade criu-libsUpgrade aardvark-dnsUpgrade buildah-tests-debuginfoUpgrade podman-debugsourceUpgrade podman-testsUpgrade crunUpgrade cockpit-podmanUpgrade containernetworking-plugins-debuginfoUpgrade python3-podmanUpgrade container-selinuxUpgrade conmonUpgrade slirp4netns-debugsourceUpgrade libslirp-develUpgrade libslirpUpgrade fuse-overlayfs-debugsourceUpgrade crun-debuginfoUpgrade criu-debuginfoUpgrade containers-commonUpgrade skopeo-debuginfoUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runcUpgrade skopeoUpgrade criuUpgrade toolbox-debugsourceUpgrade podman-remoteUpgrade podman-remote-debuginfoNo solution existsUpgrade buildahUpgrade crun-debugsourceUpgrade podmanUpgrade criu-debugsourceUpgrade fuse-overlayfsUpgrade buildah-debugsourceUpgrade toolbox-debuginfoUpgrade udicaUpgrade podman-catatonitUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-testsUpgrade podman-debuginfoUpgrade netavarkUpgrade podman-gvproxy-debuginfoUpgrade critUpgrade conmon-debugsourceUpgrade containernetworking-pluginsUpgrade libslirp-debuginfoUpgrade buildah-debuginfoUpgrade toolboxUpgrade skopeo-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-catatonit-debuginfo | Nov 8, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade criu-libs-debuginfoUpgrade podmanUpgrade fuse-overlayfs-debuginfoUpgrade runc-debugsourceUpgrade buildahUpgrade buildah-debugsourceUpgrade containernetworking-pluginsUpgrade podman-catatonit-debuginfoUpgrade slirp4netns-debuginfoUpgrade buildah-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runcUpgrade podman-catatonitUpgrade criuUpgrade critUpgrade podman-remoteUpgrade containernetworking-plugins-debuginfoUpgrade criu-debugsourceUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade fuse-overlayfsUpgrade python3-criuUpgrade libslirp-debugsourceUpgrade podman-plugins-debuginfoUpgrade crunUpgrade podman-gvproxy-debuginfoUpgrade podman-debugsourceUpgrade runc-debuginfoUpgrade libslirp-develUpgrade podman-remote-debuginfoUpgrade containers-commonUpgrade criu-debuginfoUpgrade podman-pluginsUpgrade netavarkUpgrade slirp4netns-debugsourceUpgrade aardvark-dnsUpgrade libslirpUpgrade crun-debuginfoUpgrade criu-develUpgrade conmonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxyUpgrade crun-debugsourceUpgrade conmon-debugsourceUpgrade slirp4netnsUpgrade podman-testsUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfo | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade runc | Apr 4, 2023 | Mar 3, 2023 |
| Ubuntu | — | Upgrade runcUpgrade runc (Ubuntu Pro) | May 19, 2023 | Mar 3, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub