runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-umountUpgrade oci-systemd-hook | May 13, 2022 | Feb 11, 2019 |
| Alpine Linux | — | Upgrade flatpakUpgrade runcUpgrade lxc | Aug 22, 2024 | Feb 11, 2019 |
| Amazon_linux | — | Upgrade docker | Feb 12, 2019 | Feb 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 11, 2019 |
| Centos_linux | — | Upgrade oci-umountUpgrade slirp4netns-debuginfoUpgrade skopeoUpgrade podmanUpgrade podman-debugsourceUpgrade containers-commonUpgrade slirp4netns-debugsourceUpgrade docker-lvm-pluginUpgrade containernetworking-pluginsUpgrade docker-v1.10-migratorUpgrade containernetworking-plugins-debuginfoUpgrade docker-rhel-push-pluginUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade docker-novolume-pluginUpgrade runc-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade dockerUpgrade docker-commonUpgrade runc-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade fuse-overlayfsUpgrade oci-systemd-hook-debuginfoUpgrade skopeo-debuginfoUpgrade podman-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade container-selinuxUpgrade buildah-debuginfoUpgrade oci-systemd-hookUpgrade skopeo-debugsourceUpgrade docker-logrotateUpgrade buildahUpgrade slirp4netnsUpgrade podman-dockerUpgrade oci-umount-debuginfoUpgrade oci-umount-debugsourceUpgrade runcUpgrade docker-debuginfoUpgrade docker-client | Aug 28, 2019 | Feb 11, 2019 |
| Debian | — | Upgrade lxcUpgrade runc | Jul 30, 2024 | Feb 11, 2019 |
| Docker | — | Upgrade to Docker v18.09.2 | Feb 12, 2019 | Feb 12, 2019 |
| Docker_ee | — | Upgrade Docker EE to version 18.09.2 | Nov 25, 2019 | Feb 11, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade docker-engine | Feb 22, 2019 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Mar 11, 2019 | Feb 11, 2019 |
| Oracle_linux | — | Upgrade runcUpgrade buildahUpgrade containers-commonUpgrade container-selinuxUpgrade docker-engineUpgrade oci-systemd-hookUpgrade containernetworking-pluginsUpgrade podman-dockerUpgrade oci-umountUpgrade podmanUpgrade fuse-overlayfsUpgrade skopeoUpgrade slirp4netns | Feb 12, 2019 | Feb 11, 2019 |
| Redhat Openshift | — | Upgrade docker | Feb 27, 2019 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade podmanUpgrade oci-systemd-hook-debuginfoNo solution existsUpgrade fuse-overlayfsUpgrade skopeo-debugsourceUpgrade runc-debugsourceUpgrade oci-umountUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade skopeo-debuginfoUpgrade podman-dockerUpgrade slirp4netnsUpgrade runcUpgrade buildahUpgrade podman-debuginfoUpgrade runc-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debuginfoUpgrade oci-systemd-hookUpgrade podman-debugsourceUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade oci-umount-debugsourceUpgrade oci-umount-debuginfoUpgrade slirp4netns-debugsourceUpgrade containers-commonUpgrade containernetworking-plugins-debuginfoUpgrade container-selinux | Feb 12, 2019 | Feb 11, 2019 |
| Rocky_linux | — | Upgrade oci-umount-debugsourceUpgrade oci-systemd-hookUpgrade oci-systemd-hook-debugsourceUpgrade oci-umountUpgrade oci-systemd-hook-debuginfoUpgrade oci-umount-debuginfo | Mar 12, 2024 | Feb 11, 2019 |
| Suse | — | Upgrade go1.12Upgrade flatpak-develUpgrade go1.11-raceUpgrade system-user-flatpakUpgrade runcUpgrade docker-libnetworkUpgrade go-raceUpgrade docker-zsh-completionUpgrade libflatpak0Upgrade docker-runcUpgrade lxcUpgrade pam_cgfsUpgrade docker-testUpgrade flatpakUpgrade containerdUpgrade go1.11-docUpgrade runc-testUpgrade golang-github-docker-libnetworkUpgrade go-docUpgrade lxcfs-hooks-lxcUpgrade dockerUpgrade go1.11Upgrade containerd-ctrUpgrade flatpak-zsh-completionUpgrade go1.12-docUpgrade containerd-testUpgrade lxcfsUpgrade goUpgrade typelib-1_0-flatpak-1_0Upgrade docker-bash-completionUpgrade docker-runc-testUpgrade lxc-bash-completionUpgrade go1.12-raceUpgrade liblxc-develUpgrade liblxc1 | Feb 20, 2019 | Feb 11, 2019 |
| Ubuntu | — | Upgrade docker.io | Jul 9, 2019 | Feb 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub