runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade containernetworking-pluginsUpgrade containers-commonUpgrade criuUpgrade podman-pluginsUpgrade criu-libsUpgrade python3-podmanUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade toolboxUpgrade netavarkUpgrade fuse-overlayfsUpgrade skopeoUpgrade crunUpgrade podman-catatonitUpgrade criu-develUpgrade skopeo-testsUpgrade conmonUpgrade podmanUpgrade libslirpUpgrade slirp4netnsUpgrade podman-remoteUpgrade aardvark-dnsUpgrade critUpgrade runcUpgrade python3-criuUpgrade podman-testsUpgrade podman-dockerUpgrade buildah-testsUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade toolbox-testsUpgrade container-selinuxUpgrade buildahUpgrade udica | Nov 16, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | Mar 3, 2023 |
| Amazon Linux Ami 2 | — | Upgrade runc-debuginfoUpgrade runc | Jun 7, 2023 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade runc-debugsourceUpgrade runc-debuginfoUpgrade runc | Feb 17, 2025 | Feb 20, 2023 |
| Centos_linux | — | Upgrade podman-pluginsUpgrade runcUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeoUpgrade container-selinuxUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade python3-criuUpgrade podmanUpgrade podman-gvproxyUpgrade slirp4netns-debuginfoUpgrade crunUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debugsourceUpgrade skopeo-debugsourceUpgrade podman-remoteUpgrade podman-testsUpgrade skopeo-debuginfoUpgrade podman-catatonitUpgrade udicaUpgrade libslirp-debuginfoUpgrade toolbox-debugsourceUpgrade podman-debuginfoUpgrade buildah-testsUpgrade toolbox-testsUpgrade critUpgrade criuUpgrade podman-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade buildahUpgrade containernetworking-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade criu-libs-debuginfoUpgrade cockpit-podmanUpgrade oci-seccomp-bpf-hookUpgrade conmon-debugsourceUpgrade conmonUpgrade buildah-debuginfoUpgrade libslirp-develUpgrade conmon-debuginfoUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-tests-debuginfoUpgrade libslirpUpgrade criu-debugsourceUpgrade buildah-debugsourceUpgrade skopeo-testsUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade netavarkUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade python3-podmanUpgrade podman-remote-debuginfoUpgrade criu-libsUpgrade toolboxUpgrade runc-debugsourceUpgrade podman-catatonit-debuginfoUpgrade criu-devel | Nov 8, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade runc | Mar 29, 2023 | Mar 3, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | May 9, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Jan 10, 2024 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade podman-catatonitUpgrade containers-commonUpgrade conmonUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade skopeoUpgrade podmanUpgrade libslirp-develUpgrade buildah-testsUpgrade aardvark-dnsUpgrade criu-libsUpgrade buildahUpgrade criuUpgrade cockpit-podmanUpgrade libslirpUpgrade udicaUpgrade podman-pluginsUpgrade critUpgrade podman-dockerUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade podman-remoteUpgrade slirp4netnsUpgrade skopeo-testsUpgrade container-selinuxUpgrade runcUpgrade crunUpgrade podman-testsUpgrade podman-gvproxyUpgrade criu-devel | Jul 20, 2023 | Feb 20, 2023 |
| Redhat Openshift | — | Upgrade runc | Jun 26, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade python3-podmanUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade podman-dockerUpgrade crun-debuginfoUpgrade aardvark-dnsUpgrade buildah-tests-debuginfoUpgrade crunUpgrade libslirp-develUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-testsUpgrade conmon-debuginfoUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade buildah-testsUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade runc-debuginfoUpgrade criu-develUpgrade slirp4netns-debugsourceUpgrade criu-libsUpgrade criu-debuginfoUpgrade libslirpUpgrade podman-testsUpgrade podman-gvproxyUpgrade podman-plugins-debuginfoUpgrade python3-criuUpgrade skopeo-debuginfoUpgrade runc-debugsourceUpgrade containers-commonUpgrade conmonUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade container-selinuxUpgrade buildahUpgrade podmanUpgrade podman-catatonit-debuginfoUpgrade toolbox-debugsourceNo solution existsUpgrade fuse-overlayfs-debuginfoUpgrade podman-remoteUpgrade podman-remote-debuginfoUpgrade critUpgrade toolboxUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade toolbox-testsUpgrade podman-gvproxy-debuginfoUpgrade netavarkUpgrade skopeo-debugsourceUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade runcUpgrade crun-debugsourceUpgrade criuUpgrade udicaUpgrade fuse-overlayfsUpgrade skopeoUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debugsourceUpgrade toolbox-debuginfoUpgrade podman-debuginfoUpgrade podman-plugins | Nov 8, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade podman-gvproxyUpgrade crun-debugsourceUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-develUpgrade conmon-debuginfoUpgrade slirp4netnsUpgrade podman-debugsourceUpgrade podman-testsUpgrade podman-pluginsUpgrade netavarkUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade conmonUpgrade criu-develUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-remote-debuginfoUpgrade runc-debuginfoUpgrade containers-commonUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade buildah-debuginfoUpgrade libslirpUpgrade criu-debuginfoUpgrade criuUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade fuse-overlayfsUpgrade libslirp-debugsourceUpgrade containernetworking-pluginsUpgrade buildahUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade slirp4netns-debuginfoUpgrade crunUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-testsUpgrade podman-remoteUpgrade libslirp-debuginfoUpgrade python3-criuUpgrade podmanUpgrade podman-plugins-debuginfoUpgrade buildah-debugsourceUpgrade runcUpgrade podman-catatonit-debuginfoUpgrade podman-catatonitUpgrade critUpgrade podman-debuginfoUpgrade criu-debugsource | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade runc | Apr 4, 2023 | Mar 3, 2023 |
| Ubuntu | — | Upgrade runc (Ubuntu Pro)Upgrade runc | May 19, 2023 | Mar 3, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub