runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-umountUpgrade oci-systemd-hook | May 13, 2022 | Feb 11, 2019 |
| Alpine Linux | — | Upgrade runcUpgrade lxcUpgrade flatpak | Aug 22, 2024 | Feb 11, 2019 |
| Amazon_linux | — | Upgrade docker | Feb 12, 2019 | Feb 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 11, 2019 |
| Centos_linux | — | Upgrade buildah-debugsourceUpgrade podman-debugsourceUpgrade dockerUpgrade docker-lvm-pluginUpgrade slirp4netns-debuginfoUpgrade containernetworking-pluginsUpgrade skopeoUpgrade podmanUpgrade slirp4netns-debugsourceUpgrade containers-commonUpgrade oci-umountUpgrade runc-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade docker-commonUpgrade docker-rhel-push-pluginUpgrade docker-v1.10-migratorUpgrade docker-novolume-pluginUpgrade buildah-debuginfoUpgrade podman-debuginfoUpgrade oci-umount-debuginfoUpgrade docker-clientUpgrade container-selinuxUpgrade docker-logrotateUpgrade skopeo-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade oci-systemd-hookUpgrade runc-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade podman-dockerUpgrade skopeo-debugsourceUpgrade docker-debuginfoUpgrade slirp4netnsUpgrade runcUpgrade oci-umount-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade fuse-overlayfsUpgrade buildah | Aug 28, 2019 | Feb 11, 2019 |
| Debian | — | Upgrade runcUpgrade lxc | Jul 30, 2024 | Feb 11, 2019 |
| Docker | — | Upgrade to Docker v18.09.2 | Feb 12, 2019 | Feb 12, 2019 |
| Docker_ee | — | Upgrade Docker EE to version 18.09.2 | Nov 25, 2019 | Feb 11, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade docker-engine | Feb 22, 2019 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Mar 11, 2019 | Feb 11, 2019 |
| Oracle_linux | — | Upgrade containers-commonUpgrade container-selinuxUpgrade oci-systemd-hookUpgrade runcUpgrade containernetworking-pluginsUpgrade docker-engineUpgrade buildahUpgrade skopeoUpgrade podmanUpgrade slirp4netnsUpgrade oci-umountUpgrade fuse-overlayfsUpgrade podman-docker | Feb 12, 2019 | Feb 11, 2019 |
| Redhat Openshift | — | Upgrade docker | Feb 27, 2019 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade slirp4netnsUpgrade oci-systemd-hook-debugsourceUpgrade buildahUpgrade buildah-debuginfoUpgrade oci-umountUpgrade podman-debuginfoUpgrade runcUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfs-debugsourceNo solution existsUpgrade podmanUpgrade runc-debugsourceUpgrade skopeo-debuginfoUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade skopeoUpgrade oci-systemd-hook-debuginfoUpgrade skopeo-debugsourceUpgrade container-selinuxUpgrade oci-umount-debugsourceUpgrade oci-systemd-hookUpgrade runc-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade containers-commonUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade slirp4netns-debuginfoUpgrade oci-umount-debuginfo | Feb 12, 2019 | Feb 11, 2019 |
| Rocky_linux | — | Upgrade oci-umount-debugsourceUpgrade oci-systemd-hookUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade oci-umount | Mar 12, 2024 | Feb 11, 2019 |
| Suse | — | Upgrade go-raceUpgrade lxcUpgrade go1.12Upgrade docker-runcUpgrade docker-zsh-completionUpgrade flatpak-develUpgrade docker-libnetworkUpgrade pam_cgfsUpgrade system-user-flatpakUpgrade libflatpak0Upgrade go1.11-raceUpgrade docker-testUpgrade runcUpgrade containerd-ctrUpgrade lxc-bash-completionUpgrade liblxc-develUpgrade lxcfsUpgrade runc-testUpgrade go1.12-raceUpgrade docker-runc-testUpgrade typelib-1_0-flatpak-1_0Upgrade goUpgrade docker-bash-completionUpgrade liblxc1Upgrade dockerUpgrade golang-github-docker-libnetworkUpgrade go-docUpgrade lxcfs-hooks-lxcUpgrade go1.11-docUpgrade flatpakUpgrade containerdUpgrade go1.11Upgrade go1.12-docUpgrade flatpak-zsh-completionUpgrade containerd-test | Feb 20, 2019 | Feb 11, 2019 |
| Ubuntu | — | Upgrade docker.io | Jul 9, 2019 | Feb 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub