runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-umountUpgrade oci-systemd-hook | May 13, 2022 | Feb 11, 2019 |
| Alpine Linux | — | Upgrade flatpakUpgrade lxcUpgrade runc | Aug 22, 2024 | Feb 11, 2019 |
| Amazon_linux | — | Upgrade docker | Feb 12, 2019 | Feb 8, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 11, 2019 |
| Centos_linux | — | Upgrade runc-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-pluginsUpgrade docker-commonUpgrade oci-umountUpgrade dockerUpgrade podman-debugsourceUpgrade skopeoUpgrade docker-lvm-pluginUpgrade podmanUpgrade slirp4netns-debugsourceUpgrade containers-commonUpgrade containernetworking-plugins-debuginfoUpgrade docker-rhel-push-pluginUpgrade buildah-debugsourceUpgrade docker-novolume-pluginUpgrade docker-v1.10-migratorUpgrade podman-dockerUpgrade oci-systemd-hook-debuginfoUpgrade runcUpgrade slirp4netnsUpgrade oci-umount-debugsourceUpgrade container-selinuxUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade oci-systemd-hookUpgrade skopeo-debugsourceUpgrade buildahUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount-debuginfoUpgrade docker-debuginfoUpgrade skopeo-debuginfoUpgrade podman-debuginfoUpgrade docker-logrotateUpgrade fuse-overlayfsUpgrade docker-client | Aug 28, 2019 | Feb 11, 2019 |
| Debian | — | Upgrade lxcUpgrade runc | Jul 30, 2024 | Feb 11, 2019 |
| Docker | — | Upgrade to Docker v18.09.2 | Feb 12, 2019 | Feb 12, 2019 |
| Docker_ee | — | Upgrade Docker EE to version 18.09.2 | Nov 25, 2019 | Feb 11, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade docker-engine | Feb 22, 2019 | Feb 11, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Mar 11, 2019 | Feb 11, 2019 |
| Oracle_linux | — | Upgrade buildahUpgrade oci-systemd-hookUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade docker-engineUpgrade containers-commonUpgrade runcUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade skopeoUpgrade slirp4netnsUpgrade oci-umountUpgrade podman | Feb 12, 2019 | Feb 11, 2019 |
| Redhat Openshift | — | Upgrade docker | Feb 27, 2019 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade podman-debuginfoUpgrade skopeo-debugsourceUpgrade buildahUpgrade buildah-debuginfoUpgrade fuse-overlayfsUpgrade skopeoUpgrade podmanUpgrade oci-systemd-hook-debugsourceUpgrade oci-umountNo solution existsUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade runcUpgrade podman-dockerUpgrade oci-systemd-hook-debuginfoUpgrade skopeo-debuginfoUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade slirp4netns-debugsourceUpgrade oci-systemd-hookUpgrade slirp4netns-debuginfoUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade oci-umount-debuginfoUpgrade runc-debuginfoUpgrade containers-commonUpgrade oci-umount-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-debugsourceUpgrade buildah-debugsource | Feb 12, 2019 | Feb 11, 2019 |
| Rocky_linux | — | Upgrade oci-systemd-hookUpgrade oci-umount-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade oci-umount-debuginfoUpgrade oci-umount | Mar 12, 2024 | Feb 11, 2019 |
| Suse | — | Upgrade runcUpgrade flatpak-develUpgrade docker-runcUpgrade docker-libnetworkUpgrade go1.11-raceUpgrade docker-testUpgrade lxcUpgrade system-user-flatpakUpgrade go-raceUpgrade libflatpak0Upgrade docker-zsh-completionUpgrade go1.12Upgrade pam_cgfsUpgrade go1.12-raceUpgrade lxcfs-hooks-lxcUpgrade docker-runc-testUpgrade lxc-bash-completionUpgrade go-docUpgrade liblxc1Upgrade flatpakUpgrade dockerUpgrade typelib-1_0-flatpak-1_0Upgrade lxcfsUpgrade containerdUpgrade golang-github-docker-libnetworkUpgrade flatpak-zsh-completionUpgrade containerd-testUpgrade docker-bash-completionUpgrade go1.11Upgrade go1.11-docUpgrade go1.12-docUpgrade liblxc-develUpgrade goUpgrade containerd-ctrUpgrade runc-test | Feb 20, 2019 | Feb 11, 2019 |
| Ubuntu | — | Upgrade docker.io | Jul 9, 2019 | Feb 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub