runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-umountUpgrade oci-systemd-hook | May 13, 2022 | Feb 11, 2019 |
| Alpine Linux | — | Upgrade flatpakUpgrade runcUpgrade lxc | Aug 22, 2024 | Feb 11, 2019 |
| Amazon_linux | — | Upgrade docker | Feb 12, 2019 | Feb 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 11, 2019 |
| Centos_linux | — | Upgrade oci-systemd-hook-debugsourceUpgrade buildahUpgrade skopeo-debugsourceUpgrade container-selinuxUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade oci-systemd-hookUpgrade fuse-overlayfs-debugsourceUpgrade runcUpgrade oci-umount-debuginfoUpgrade oci-umount-debugsourceUpgrade fuse-overlayfsUpgrade podman-debuginfoUpgrade podman-dockerUpgrade skopeo-debuginfoUpgrade docker-debuginfoUpgrade slirp4netnsUpgrade docker-logrotateUpgrade docker-clientUpgrade podmanUpgrade docker-lvm-pluginUpgrade oci-umountUpgrade containernetworking-pluginsUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade containers-commonUpgrade docker-commonUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade buildah-debugsourceUpgrade skopeoUpgrade docker-rhel-push-pluginUpgrade dockerUpgrade docker-v1.10-migratorUpgrade docker-novolume-pluginUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-debugsource | Aug 28, 2019 | Feb 11, 2019 |
| Debian | — | Upgrade runcUpgrade lxc | Jul 30, 2024 | Feb 11, 2019 |
| Docker | — | Upgrade to Docker v18.09.2 | Feb 12, 2019 | Feb 12, 2019 |
| Docker_ee | — | Upgrade Docker EE to version 18.09.2 | Nov 25, 2019 | Feb 11, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade docker-engine | Feb 22, 2019 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Mar 11, 2019 | Feb 11, 2019 |
| Oracle_linux | — | Upgrade podman-dockerUpgrade fuse-overlayfsUpgrade podmanUpgrade oci-umountUpgrade skopeoUpgrade slirp4netnsUpgrade docker-engineUpgrade containers-commonUpgrade container-selinuxUpgrade buildahUpgrade runcUpgrade containernetworking-pluginsUpgrade oci-systemd-hook | Feb 12, 2019 | Feb 11, 2019 |
| Redhat Openshift | — | Upgrade docker | Feb 27, 2019 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade skopeo-debugsourceUpgrade buildahUpgrade oci-systemd-hook-debuginfoUpgrade buildah-debuginfoUpgrade podman-debuginfoUpgrade runcUpgrade fuse-overlayfsUpgrade skopeoUpgrade oci-systemd-hook-debugsourceUpgrade oci-umountUpgrade slirp4netnsUpgrade skopeo-debuginfoNo solution existsUpgrade podmanUpgrade runc-debugsourceUpgrade podman-dockerUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade oci-umount-debuginfoUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade oci-systemd-hookUpgrade podman-debugsourceUpgrade slirp4netns-debuginfoUpgrade oci-umount-debugsourceUpgrade containers-commonUpgrade containernetworking-plugins-debugsource | Feb 12, 2019 | Feb 11, 2019 |
| Rocky_linux | — | Upgrade oci-umount-debugsourceUpgrade oci-systemd-hookUpgrade oci-systemd-hook-debuginfoUpgrade oci-umount-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount | Mar 12, 2024 | Feb 11, 2019 |
| Suse | — | Upgrade docker-zsh-completionUpgrade docker-libnetworkUpgrade lxcUpgrade go1.11-raceUpgrade go-raceUpgrade go1.12Upgrade docker-runcUpgrade docker-testUpgrade libflatpak0Upgrade flatpak-develUpgrade pam_cgfsUpgrade runcUpgrade system-user-flatpakUpgrade containerd-ctrUpgrade goUpgrade flatpak-zsh-completionUpgrade golang-github-docker-libnetworkUpgrade go-docUpgrade liblxc1Upgrade typelib-1_0-flatpak-1_0Upgrade lxcfsUpgrade docker-bash-completionUpgrade go1.11Upgrade go1.12-docUpgrade containerd-testUpgrade lxc-bash-completionUpgrade liblxc-develUpgrade containerdUpgrade go1.11-docUpgrade flatpakUpgrade runc-testUpgrade docker-runc-testUpgrade go1.12-raceUpgrade lxcfs-hooks-lxcUpgrade docker | Feb 20, 2019 | Feb 11, 2019 |
| Ubuntu | — | Upgrade docker.io | Jul 9, 2019 | Feb 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub