runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-systemd-hookUpgrade oci-umount | May 13, 2022 | Feb 11, 2019 |
| Alpine Linux | — | Upgrade lxcUpgrade runcUpgrade flatpak | Aug 22, 2024 | Feb 11, 2019 |
| Amazon_linux | — | Upgrade docker | Feb 12, 2019 | Feb 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 11, 2019 |
| Centos_linux | — | Upgrade containernetworking-plugins-debuginfoUpgrade podmanUpgrade containernetworking-pluginsUpgrade buildah-debugsourceUpgrade docker-rhel-push-pluginUpgrade oci-umountUpgrade containernetworking-plugins-debugsourceUpgrade podman-debugsourceUpgrade docker-commonUpgrade docker-v1.10-migratorUpgrade containers-commonUpgrade dockerUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade docker-novolume-pluginUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade docker-lvm-pluginUpgrade slirp4netns-debuginfoUpgrade docker-debuginfoUpgrade slirp4netnsUpgrade fuse-overlayfs-debugsourceUpgrade oci-umount-debugsourceUpgrade oci-umount-debuginfoUpgrade podman-dockerUpgrade runc-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade oci-systemd-hookUpgrade oci-systemd-hook-debugsourceUpgrade skopeo-debugsourceUpgrade container-selinuxUpgrade buildahUpgrade buildah-debuginfoUpgrade skopeo-debuginfoUpgrade podman-debuginfoUpgrade fuse-overlayfsUpgrade docker-clientUpgrade docker-logrotateUpgrade runc | Aug 28, 2019 | Feb 11, 2019 |
| Debian | — | Upgrade runcUpgrade lxc | Jul 30, 2024 | Feb 11, 2019 |
| Docker | — | Upgrade to Docker v18.09.2 | Feb 12, 2019 | Feb 12, 2019 |
| Docker_ee | — | Upgrade Docker EE to version 18.09.2 | Nov 25, 2019 | Feb 11, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade docker-engine | Feb 22, 2019 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Mar 11, 2019 | Feb 11, 2019 |
| Oracle_linux | — | Upgrade container-selinuxUpgrade buildahUpgrade runcUpgrade docker-engineUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade oci-systemd-hookUpgrade slirp4netnsUpgrade oci-umountUpgrade fuse-overlayfsUpgrade podmanUpgrade skopeoUpgrade podman-docker | Feb 12, 2019 | Feb 11, 2019 |
| Redhat Openshift | — | Upgrade docker | Feb 27, 2019 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade runc-debuginfoUpgrade oci-systemd-hookUpgrade buildah-debugsourceUpgrade oci-umount-debugsourceUpgrade oci-umount-debuginfoUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade containers-commonUpgrade podmanUpgrade podman-dockerUpgrade runc-debugsourceNo solution existsUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade runcUpgrade oci-umountUpgrade podman-debuginfoUpgrade buildah-debuginfoUpgrade buildahUpgrade fuse-overlayfsUpgrade skopeoUpgrade oci-systemd-hook-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade skopeo-debuginfoUpgrade slirp4netnsUpgrade skopeo-debugsource | Feb 12, 2019 | Feb 11, 2019 |
| Rocky_linux | — | Upgrade oci-systemd-hookUpgrade oci-umount-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade oci-umount | Mar 12, 2024 | Feb 11, 2019 |
| Suse | — | Upgrade docker-testUpgrade go1.11-raceUpgrade go1.12Upgrade flatpak-develUpgrade docker-libnetworkUpgrade docker-runcUpgrade runcUpgrade system-user-flatpakUpgrade lxcUpgrade pam_cgfsUpgrade docker-zsh-completionUpgrade go-raceUpgrade libflatpak0Upgrade go1.12-docUpgrade go1.12-raceUpgrade docker-runc-testUpgrade docker-bash-completionUpgrade lxcfs-hooks-lxcUpgrade dockerUpgrade typelib-1_0-flatpak-1_0Upgrade liblxc-develUpgrade lxcfsUpgrade lxc-bash-completionUpgrade go1.11Upgrade runc-testUpgrade liblxc1Upgrade golang-github-docker-libnetworkUpgrade go-docUpgrade containerdUpgrade go1.11-docUpgrade goUpgrade flatpakUpgrade flatpak-zsh-completionUpgrade containerd-testUpgrade containerd-ctr | Feb 20, 2019 | Feb 11, 2019 |
| Ubuntu | — | Upgrade docker.io | Jul 9, 2019 | Feb 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub