runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-systemd-hookUpgrade oci-umount | May 13, 2022 | Feb 11, 2019 |
| Alpine Linux | — | Upgrade flatpakUpgrade runcUpgrade lxc | Aug 22, 2024 | Feb 11, 2019 |
| Amazon_linux | — | Upgrade docker | Feb 12, 2019 | Feb 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 11, 2019 |
| Centos_linux | — | Upgrade oci-systemd-hook-debuginfoUpgrade slirp4netnsUpgrade oci-umount-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade container-selinuxUpgrade oci-systemd-hookUpgrade skopeo-debugsourceUpgrade buildahUpgrade runc-debugsourceUpgrade docker-clientUpgrade docker-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade skopeo-debuginfoUpgrade oci-umount-debuginfoUpgrade fuse-overlayfsUpgrade buildah-debuginfoUpgrade docker-logrotateUpgrade podman-debuginfoUpgrade runcUpgrade podman-dockerUpgrade docker-novolume-pluginUpgrade docker-rhel-push-pluginUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade skopeoUpgrade oci-umountUpgrade containernetworking-plugins-debugsourceUpgrade dockerUpgrade docker-v1.10-migratorUpgrade containers-commonUpgrade podmanUpgrade docker-commonUpgrade podman-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade docker-lvm-plugin | Aug 28, 2019 | Feb 11, 2019 |
| Debian | — | Upgrade runcUpgrade lxc | Jul 30, 2024 | Feb 11, 2019 |
| Docker | — | Upgrade to Docker v18.09.2 | Feb 12, 2019 | Feb 12, 2019 |
| Docker_ee | — | Upgrade Docker EE to version 18.09.2 | Nov 25, 2019 | Feb 11, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade docker-engine | Feb 22, 2019 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Mar 11, 2019 | Feb 11, 2019 |
| Oracle_linux | — | Upgrade containernetworking-pluginsUpgrade oci-systemd-hookUpgrade docker-engineUpgrade container-selinuxUpgrade buildahUpgrade containers-commonUpgrade runcUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade podmanUpgrade oci-umountUpgrade slirp4netnsUpgrade skopeo | Feb 12, 2019 | Feb 11, 2019 |
| Redhat Openshift | — | Upgrade docker | Feb 27, 2019 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade slirp4netnsUpgrade oci-systemd-hook-debuginfoUpgrade oci-umountUpgrade skopeoUpgrade fuse-overlayfsNo solution existsUpgrade podman-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildahUpgrade runcUpgrade runc-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podmanUpgrade buildah-debuginfoUpgrade skopeo-debugsourceUpgrade skopeo-debuginfoUpgrade podman-dockerUpgrade oci-systemd-hook-debugsourceUpgrade slirp4netns-debuginfoUpgrade container-selinuxUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade oci-umount-debugsourceUpgrade runc-debuginfoUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade oci-umount-debuginfoUpgrade containers-commonUpgrade oci-systemd-hook | Feb 12, 2019 | Feb 11, 2019 |
| Rocky_linux | — | Upgrade oci-umount-debugsourceUpgrade oci-systemd-hookUpgrade oci-umountUpgrade oci-umount-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade oci-systemd-hook-debuginfo | Mar 12, 2024 | Feb 11, 2019 |
| Suse | — | Upgrade flatpak-zsh-completionUpgrade containerd-ctrUpgrade go-docUpgrade containerd-testUpgrade goUpgrade dockerUpgrade liblxc1Upgrade go1.12-docUpgrade go1.11-docUpgrade containerdUpgrade docker-runc-testUpgrade flatpakUpgrade lxcfs-hooks-lxcUpgrade lxcfsUpgrade docker-bash-completionUpgrade lxc-bash-completionUpgrade go1.11Upgrade runc-testUpgrade typelib-1_0-flatpak-1_0Upgrade go1.12-raceUpgrade golang-github-docker-libnetworkUpgrade liblxc-develUpgrade lxcUpgrade runcUpgrade flatpak-develUpgrade libflatpak0Upgrade pam_cgfsUpgrade system-user-flatpakUpgrade docker-zsh-completionUpgrade docker-testUpgrade go1.11-raceUpgrade docker-runcUpgrade docker-libnetworkUpgrade go-raceUpgrade go1.12 | Feb 20, 2019 | Feb 11, 2019 |
| Ubuntu | — | Upgrade docker.io | Jul 9, 2019 | Feb 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub