runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-systemd-hookUpgrade oci-umount | May 13, 2022 | Feb 11, 2019 |
| Alpine Linux | — | Upgrade lxcUpgrade runcUpgrade flatpak | Aug 22, 2024 | Feb 11, 2019 |
| Amazon_linux | — | Upgrade docker | Feb 12, 2019 | Feb 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 11, 2019 |
| Centos_linux | — | Upgrade podman-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade skopeoUpgrade slirp4netns-debuginfoUpgrade oci-umountUpgrade podmanUpgrade slirp4netns-debugsourceUpgrade buildah-debugsourceUpgrade docker-rhel-push-pluginUpgrade docker-novolume-pluginUpgrade docker-commonUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade docker-v1.10-migratorUpgrade docker-lvm-pluginUpgrade containernetworking-plugins-debuginfoUpgrade runc-debuginfoUpgrade dockerUpgrade slirp4netnsUpgrade oci-umount-debugsourceUpgrade oci-systemd-hookUpgrade oci-umount-debuginfoUpgrade docker-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade podman-debuginfoUpgrade buildah-debuginfoUpgrade container-selinuxUpgrade fuse-overlayfsUpgrade docker-logrotateUpgrade runcUpgrade skopeo-debuginfoUpgrade runc-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade skopeo-debugsourceUpgrade buildahUpgrade docker-clientUpgrade fuse-overlayfs-debugsourceUpgrade podman-docker | Aug 28, 2019 | Feb 11, 2019 |
| Debian | — | Upgrade runcUpgrade lxc | Jul 30, 2024 | Feb 11, 2019 |
| Docker | — | Upgrade to Docker v18.09.2 | Feb 12, 2019 | Feb 12, 2019 |
| Docker_ee | — | Upgrade Docker EE to version 18.09.2 | Nov 25, 2019 | Feb 11, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade docker-engine | Feb 22, 2019 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Mar 11, 2019 | Feb 11, 2019 |
| Oracle_linux | — | Upgrade podmanUpgrade oci-umountUpgrade slirp4netnsUpgrade skopeoUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade containernetworking-pluginsUpgrade oci-systemd-hookUpgrade container-selinuxUpgrade runcUpgrade docker-engineUpgrade buildahUpgrade containers-common | Feb 12, 2019 | Feb 11, 2019 |
| Redhat Openshift | — | Upgrade docker | Feb 27, 2019 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade buildah-debugsourceUpgrade podman-debugsourceUpgrade container-selinuxUpgrade containernetworking-plugins-debugsourceUpgrade oci-umount-debuginfoUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade oci-systemd-hookUpgrade containernetworking-pluginsUpgrade oci-umount-debugsourceUpgrade containers-commonUpgrade runc-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade runcUpgrade slirp4netnsUpgrade oci-systemd-hook-debugsourceUpgrade skopeo-debuginfoUpgrade skopeoUpgrade podman-debuginfoUpgrade oci-umountUpgrade buildah-debuginfoUpgrade buildahUpgrade podmanUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-debugsourceUpgrade podman-dockerUpgrade fuse-overlayfs-debuginfoNo solution existsUpgrade runc-debugsource | Feb 12, 2019 | Feb 11, 2019 |
| Rocky_linux | — | Upgrade oci-umountUpgrade oci-systemd-hook-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount-debuginfoUpgrade oci-systemd-hookUpgrade oci-umount-debugsource | Mar 12, 2024 | Feb 11, 2019 |
| Suse | — | Upgrade go-raceUpgrade docker-runcUpgrade go1.11-raceUpgrade flatpak-develUpgrade docker-testUpgrade docker-libnetworkUpgrade libflatpak0Upgrade system-user-flatpakUpgrade go1.12Upgrade runcUpgrade pam_cgfsUpgrade lxcUpgrade docker-zsh-completionUpgrade typelib-1_0-flatpak-1_0Upgrade lxc-bash-completionUpgrade golang-github-docker-libnetworkUpgrade lxcfs-hooks-lxcUpgrade dockerUpgrade docker-bash-completionUpgrade goUpgrade liblxc1Upgrade containerd-testUpgrade go1.12-raceUpgrade docker-runc-testUpgrade runc-testUpgrade go1.11-docUpgrade containerdUpgrade flatpakUpgrade go-docUpgrade go1.12-docUpgrade go1.11Upgrade flatpak-zsh-completionUpgrade containerd-ctrUpgrade liblxc-develUpgrade lxcfs | Feb 20, 2019 | Feb 11, 2019 |
| Ubuntu | — | Upgrade docker.io | Jul 9, 2019 | Feb 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub