runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
CVSS Details
- CVSS 3.1 Base Score: 8.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-criuUpgrade skopeo-testsUpgrade libslirp-develUpgrade containers-commonUpgrade skopeoUpgrade containernetworking-pluginsUpgrade libslirpUpgrade udicaUpgrade toolboxUpgrade python-podman-apiUpgrade cockpit-podmanUpgrade critUpgrade fuse-overlayfsUpgrade criuUpgrade container-selinuxUpgrade slirp4netnsUpgrade conmon | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade k3sUpgrade runc | Aug 22, 2024 | May 27, 2021 |
| Amazon Linux Ami 2 | — | Upgrade runc-debuginfoUpgrade runc | Jul 4, 2022 | May 27, 2021 |
| Amazon_linux | — | Upgrade runc | May 20, 2021 | May 14, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 27, 2021 |
| Centos_linux | — | Upgrade podman-remoteUpgrade toolboxUpgrade podman-dockerUpgrade skopeoUpgrade skopeo-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade skopeo-testsUpgrade libslirpUpgrade podman-plugins-debuginfoUpgrade docker-rhel-push-pluginUpgrade podman-remote-debuginfoUpgrade runc-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade runcUpgrade slirp4netnsUpgrade container-selinuxUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debugsourceUpgrade conmonUpgrade udicaUpgrade podman-catatonit-debuginfoUpgrade podman-testsUpgrade docker-v1.10-migratorUpgrade docker-lvm-pluginUpgrade critUpgrade libslirp-debuginfoUpgrade crunUpgrade podman-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade buildah-debugsourceUpgrade dockerUpgrade criuUpgrade conmon-debuginfoUpgrade docker-clientUpgrade criu-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade buildah-testsUpgrade cockpit-podmanUpgrade fuse-overlayfsUpgrade docker-logrotateUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade conmon-debugsourceUpgrade podmanUpgrade buildah-tests-debuginfoUpgrade python-podman-apiUpgrade crun-debugsourceUpgrade crun-debuginfoUpgrade criu-debugsourceUpgrade containernetworking-pluginsUpgrade skopeo-debugsourceUpgrade docker-debuginfoUpgrade docker-commonUpgrade libslirp-develUpgrade docker-novolume-pluginUpgrade buildah-debuginfoUpgrade buildahUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hook | Jun 1, 2021 | May 27, 2021 |
| Debian | — | Upgrade runc | Mar 29, 2023 | May 27, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Jul 12, 2021 | May 27, 2021 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-engine | Jul 18, 2023 | May 27, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade docker-engine | Aug 10, 2021 | May 27, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade docker-engineUpgrade docker-engine-selinux | Sep 29, 2021 | May 27, 2021 |
| Oracle_linux | — | Upgrade podman-pluginsUpgrade libslirp-develUpgrade skopeoUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade podmanUpgrade containers-commonUpgrade docker-engineUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade crunUpgrade podman-remoteUpgrade conmonUpgrade critUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade docker-cliUpgrade podman-catatonitUpgrade libslirpUpgrade fuse-overlayfsUpgrade buildah-testsUpgrade podman-testsUpgrade runcUpgrade criuUpgrade python-podman-apiUpgrade buildahUpgrade podman-dockerUpgrade udica | Jun 11, 2021 | May 19, 2021 |
| Redhat Openshift | — | Upgrade python-hardwareUpgrade ignitionUpgrade haproxyUpgrade rteval-loadsUpgrade python-sushyUpgrade rust-afterburnUpgrade python-keystoneauth1Upgrade openshift-clientsUpgrade openstack-ironic-python-agentUpgrade python-jsonschemaUpgrade python-pyrsistentUpgrade python-oslo-utilsUpgrade python-oslo-serializationUpgrade openshiftUpgrade redhat-release-coreosUpgrade toolboxUpgrade python-oslo-contextUpgrade console-login-helper-messagesUpgrade ostreeUpgrade butaneUpgrade python-debtcollectorUpgrade cri-oUpgrade cri-toolsUpgrade python-eventletUpgrade python-toozUpgrade coreos-installerUpgrade python-stevedoreUpgrade python-ironic-libUpgrade python-sushy-oem-idracUpgrade python-oslo-dbUpgrade ironic-images-ipa-x86_64Upgrade python-openstacksdkUpgrade python-oslo-i18nUpgrade kata-containersUpgrade python-openshiftUpgrade python-ironic-prometheus-exporterUpgrade openstack-ironicUpgrade openvswitch2.15Upgrade openshift-ansibleUpgrade runcUpgrade ironic-images-ipa-ppc64leUpgrade python-oslo-policyUpgrade openshift-kuryrUpgrade ironic-imagesUpgrade jenkinsUpgrade openstack-ironic-inspectorUpgrade python-oslo-configUpgrade python-oslo-concurrencyUpgrade python-oslo-upgradecheckUpgrade python-oslo-logUpgrade atomic-openshift-service-idlerUpgrade podmanUpgrade python-oslo-serviceUpgrade ovn2.13Upgrade jenkins-2-pluginsUpgrade python-kubernetes | May 25, 2021 | May 19, 2021 |
| Redhat_linux | — | Upgrade podman-catatonit-debuginfoUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade container-selinuxUpgrade podman-debugsourceNo solution existsUpgrade podman-plugins-debuginfoUpgrade skopeo-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-catatonitUpgrade skopeoUpgrade criuUpgrade skopeo-debugsourceUpgrade python3-criuUpgrade libslirp-debugsourceUpgrade runcUpgrade critUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade crunUpgrade slirp4netns-debuginfoUpgrade podman-pluginsUpgrade udicaUpgrade buildah-testsUpgrade podman-remoteUpgrade podmanUpgrade podman-testsUpgrade podman-debuginfoUpgrade cockpit-podmanUpgrade libslirp-debuginfoUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade crun-debuginfoUpgrade slirp4netnsUpgrade containernetworking-plugins-debugsourceUpgrade runc-debugsourceUpgrade criu-debuginfoUpgrade python-podman-apiUpgrade libslirp-develUpgrade containers-commonUpgrade buildah-debuginfoUpgrade runc-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade buildah-tests-debuginfoUpgrade crun-debugsourceUpgrade buildah-debugsourceUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade podman-remote-debuginfoUpgrade toolboxUpgrade conmon-debugsourceUpgrade conmon-debuginfoUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debugsource | Jun 1, 2021 | May 27, 2021 |
| Rocky_linux | — | Upgrade podman-remote-debuginfoUpgrade containernetworking-pluginsUpgrade critUpgrade fuse-overlayfs-debugsourceUpgrade podman-plugins-debuginfoUpgrade crun-debugsourceUpgrade skopeoUpgrade criu-debuginfoUpgrade criuUpgrade podman-catatonitUpgrade runc-debuginfoUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade runcUpgrade libslirp-debuginfoUpgrade podman-debuginfoUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade containers-commonUpgrade python3-criuUpgrade libslirp-develUpgrade podmanUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade podman-testsUpgrade slirp4netnsUpgrade skopeo-testsUpgrade podman-pluginsUpgrade buildah-debugsourceUpgrade conmonUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade conmon-debuginfoUpgrade skopeo-debugsourceUpgrade buildah-testsUpgrade slirp4netns-debugsourceUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade podman-catatonit-debuginfoUpgrade skopeo-debuginfoUpgrade libslirp | May 5, 2022 | May 27, 2021 |
| Suse | — | Upgrade docker-zsh-completionUpgrade dockerUpgrade docker-bash-completionUpgrade containerdUpgrade docker-kubic-zsh-completionUpgrade docker-kubicUpgrade docker-kubic-kubeadm-criconfigUpgrade containerd-ctrUpgrade docker-kubic-fish-completionUpgrade docker-kubic-bash-completionUpgrade docker-fish-completionUpgrade runc | Jun 12, 2021 | May 14, 2021 |
| Ubuntu | — | Upgrade runcUpgrade runc (Ubuntu Pro) | May 20, 2021 | May 14, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub