runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-umountUpgrade oci-systemd-hook | May 13, 2022 | Feb 11, 2019 |
| Alpine Linux | — | Upgrade flatpakUpgrade runcUpgrade lxc | Aug 22, 2024 | Feb 11, 2019 |
| Amazon_linux | — | Upgrade docker | Feb 12, 2019 | Feb 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 11, 2019 |
| Centos_linux | — | Upgrade slirp4netns-debugsourceUpgrade docker-rhel-push-pluginUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-debugsourceUpgrade skopeoUpgrade dockerUpgrade podmanUpgrade docker-novolume-pluginUpgrade containernetworking-plugins-debugsourceUpgrade docker-lvm-pluginUpgrade fuse-overlayfs-debuginfoUpgrade containers-commonUpgrade runc-debuginfoUpgrade docker-v1.10-migratorUpgrade oci-umountUpgrade slirp4netns-debuginfoUpgrade docker-commonUpgrade podman-debugsourceUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debugsourceUpgrade docker-logrotateUpgrade container-selinuxUpgrade buildah-debuginfoUpgrade skopeo-debuginfoUpgrade docker-clientUpgrade oci-systemd-hook-debuginfoUpgrade oci-systemd-hookUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade oci-umount-debugsourceUpgrade podman-dockerUpgrade docker-debuginfoUpgrade runcUpgrade oci-systemd-hook-debugsourceUpgrade buildahUpgrade oci-umount-debuginfoUpgrade skopeo-debugsourceUpgrade podman-debuginfo | Aug 28, 2019 | Feb 11, 2019 |
| Debian | — | Upgrade lxcUpgrade runc | Jul 30, 2024 | Feb 11, 2019 |
| Docker | — | Upgrade to Docker v18.09.2 | Feb 12, 2019 | Feb 12, 2019 |
| Docker_ee | — | Upgrade Docker EE to version 18.09.2 | Nov 25, 2019 | Feb 11, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade docker-engine | Feb 22, 2019 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Mar 11, 2019 | Feb 11, 2019 |
| Oracle_linux | — | Upgrade docker-engineUpgrade containers-commonUpgrade oci-systemd-hookUpgrade buildahUpgrade runcUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade oci-umountUpgrade slirp4netnsUpgrade fuse-overlayfsUpgrade podmanUpgrade podman-dockerUpgrade skopeo | Feb 12, 2019 | Feb 11, 2019 |
| Redhat Openshift | — | Upgrade docker | Feb 27, 2019 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade runc-debuginfoUpgrade oci-umount-debuginfoUpgrade container-selinuxUpgrade podman-debugsourceUpgrade containernetworking-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade oci-systemd-hookUpgrade containers-commonUpgrade oci-umount-debugsourceUpgrade slirp4netns-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade buildahUpgrade oci-umountUpgrade skopeoUpgrade podmanUpgrade runcUpgrade oci-systemd-hook-debugsourceUpgrade slirp4netnsUpgrade fuse-overlayfsUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade podman-dockerUpgrade podman-debuginfoUpgrade fuse-overlayfs-debuginfoNo solution existsUpgrade skopeo-debuginfo | Feb 12, 2019 | Feb 11, 2019 |
| Rocky_linux | — | Upgrade oci-systemd-hook-debugsourceUpgrade oci-umountUpgrade oci-systemd-hook-debuginfoUpgrade oci-umount-debuginfoUpgrade oci-systemd-hookUpgrade oci-umount-debugsource | Mar 12, 2024 | Feb 11, 2019 |
| Suse | — | Upgrade docker-bash-completionUpgrade containerd-ctrUpgrade dockerUpgrade typelib-1_0-flatpak-1_0Upgrade runc-testUpgrade lxcfs-hooks-lxcUpgrade lxcfsUpgrade lxc-bash-completionUpgrade go1.12-raceUpgrade docker-runc-testUpgrade liblxc-develUpgrade go1.12-docUpgrade containerd-testUpgrade go1.11Upgrade flatpak-zsh-completionUpgrade flatpakUpgrade containerdUpgrade go1.11-docUpgrade go-docUpgrade goUpgrade golang-github-docker-libnetworkUpgrade liblxc1Upgrade docker-zsh-completionUpgrade flatpak-develUpgrade go-raceUpgrade libflatpak0Upgrade go1.11-raceUpgrade docker-libnetworkUpgrade docker-runcUpgrade runcUpgrade docker-testUpgrade system-user-flatpakUpgrade go1.12Upgrade lxcUpgrade pam_cgfs | Feb 20, 2019 | Feb 11, 2019 |
| Ubuntu | — | Upgrade docker.io | Jul 9, 2019 | Feb 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub