runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
CVSS Details
- CVSS 3.1 Base Score: 8.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade conmonUpgrade fuse-overlayfsUpgrade container-selinuxUpgrade udicaUpgrade cockpit-podmanUpgrade criuUpgrade libslirpUpgrade toolboxUpgrade slirp4netnsUpgrade python-podman-apiUpgrade critUpgrade libslirp-develUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade skopeo-testsUpgrade skopeo | May 4, 2022 | May 27, 2021 |
| Alpine Linux | — | Upgrade runcUpgrade k3s | Aug 22, 2024 | May 27, 2021 |
| Amazon Linux Ami 2 | — | Upgrade runc-debuginfoUpgrade runc | Jul 4, 2022 | May 27, 2021 |
| Amazon_linux | — | Upgrade runc | May 20, 2021 | May 14, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 27, 2021 |
| Centos_linux | — | Upgrade skopeoUpgrade podman-plugins-debuginfoUpgrade runcUpgrade podman-remoteUpgrade containernetworking-plugins-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade docker-rhel-push-pluginUpgrade slirp4netns-debugsourceUpgrade toolboxUpgrade libslirpUpgrade runc-debuginfoUpgrade skopeo-debuginfoUpgrade libslirp-debuginfoUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade critUpgrade podman-dockerUpgrade skopeo-testsUpgrade docker-lvm-pluginUpgrade docker-v1.10-migratorUpgrade conmonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade container-selinuxUpgrade podman-catatonit-debuginfoUpgrade podman-testsUpgrade crunUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-debugsourceUpgrade podman-pluginsUpgrade slirp4netns-debuginfoUpgrade udicaUpgrade slirp4netnsUpgrade python3-criuUpgrade buildah-tests-debuginfoUpgrade python-podman-apiUpgrade criuUpgrade podmanUpgrade containers-commonUpgrade dockerUpgrade conmon-debuginfoUpgrade buildah-testsUpgrade podman-catatonitUpgrade docker-logrotateUpgrade libslirp-develUpgrade docker-novolume-pluginUpgrade crun-debugsourceUpgrade skopeo-debugsourceUpgrade docker-debuginfoUpgrade docker-commonUpgrade criu-debugsourceUpgrade containernetworking-pluginsUpgrade crun-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade buildahUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debugsourceUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade docker-clientUpgrade criu-debuginfo | Jun 1, 2021 | May 27, 2021 |
| Debian | — | Upgrade runc | Mar 29, 2023 | May 27, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Jul 12, 2021 | May 27, 2021 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-engine | Jul 18, 2023 | May 27, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade docker-engine | Aug 10, 2021 | May 27, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade docker-engineUpgrade docker-engine-selinux | Sep 29, 2021 | May 27, 2021 |
| Oracle_linux | — | Upgrade criuUpgrade buildahUpgrade podman-testsUpgrade libslirpUpgrade podman-catatonitUpgrade podman-dockerUpgrade python-podman-apiUpgrade cockpit-podmanUpgrade runcUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade udicaUpgrade buildah-testsUpgrade docker-cliUpgrade conmonUpgrade podman-remoteUpgrade skopeoUpgrade containers-commonUpgrade podman-pluginsUpgrade libslirp-develUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade docker-engineUpgrade container-selinuxUpgrade skopeo-testsUpgrade crunUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade crit | Jun 11, 2021 | May 19, 2021 |
| Redhat Openshift | — | Upgrade runcUpgrade python-oslo-configUpgrade python-oslo-upgradecheckUpgrade jenkinsUpgrade python-openshiftUpgrade python-oslo-serviceUpgrade openshift-ansibleUpgrade python-oslo-logUpgrade python-oslo-concurrencyUpgrade ovn2.13Upgrade ironic-images-ipa-x86_64Upgrade atomic-openshift-service-idlerUpgrade python-oslo-policyUpgrade python-openstacksdkUpgrade python-oslo-i18nUpgrade openstack-ironicUpgrade openshift-kuryrUpgrade python-kubernetesUpgrade jenkins-2-pluginsUpgrade ironic-images-ipa-ppc64leUpgrade podmanUpgrade openvswitch2.15Upgrade python-ironic-prometheus-exporterUpgrade ironic-imagesUpgrade python-oslo-dbUpgrade openstack-ironic-inspectorUpgrade kata-containersUpgrade redhat-release-coreosUpgrade butaneUpgrade rteval-loadsUpgrade python-ironic-libUpgrade python-pyrsistentUpgrade openshiftUpgrade python-sushyUpgrade python-keystoneauth1Upgrade python-stevedoreUpgrade python-jsonschemaUpgrade python-oslo-serializationUpgrade python-oslo-contextUpgrade rust-afterburnUpgrade openstack-ironic-python-agentUpgrade ostreeUpgrade python-eventletUpgrade python-toozUpgrade cri-toolsUpgrade openshift-clientsUpgrade cri-oUpgrade python-debtcollectorUpgrade ignitionUpgrade haproxyUpgrade console-login-helper-messagesUpgrade python-oslo-utilsUpgrade python-sushy-oem-idracUpgrade toolboxUpgrade coreos-installerUpgrade python-hardware | May 25, 2021 | May 19, 2021 |
| Redhat_linux | — | Upgrade slirp4netnsUpgrade criu-debuginfoUpgrade runc-debuginfoUpgrade crun-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debugsourceUpgrade libslirp-develUpgrade toolboxUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade runc-debugsourceUpgrade libslirpUpgrade fuse-overlayfs-debugsourceUpgrade podman-remote-debuginfoUpgrade containers-commonUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade crun-debugsourceUpgrade python-podman-apiUpgrade skopeo-testsUpgrade buildah-tests-debuginfoUpgrade conmon-debuginfoUpgrade conmon-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade runcUpgrade skopeo-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade crunNo solution existsUpgrade skopeo-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade cockpit-podmanUpgrade udicaUpgrade podmanUpgrade buildah-testsUpgrade buildahUpgrade podman-pluginsUpgrade container-selinuxUpgrade fuse-overlayfsUpgrade criuUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade podman-testsUpgrade libslirp-debugsourceUpgrade podman-dockerUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade critUpgrade skopeo | Jun 1, 2021 | May 27, 2021 |
| Rocky_linux | — | Upgrade crun-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-debugsourceUpgrade slirp4netnsUpgrade podman-pluginsUpgrade buildah-debugsourceUpgrade podman-testsUpgrade libslirp-debugsourceUpgrade conmonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade conmon-debugsourceUpgrade crunUpgrade slirp4netns-debugsourceUpgrade libslirpUpgrade skopeo-testsUpgrade podman-catatonit-debuginfoUpgrade skopeo-debuginfoUpgrade libslirp-develUpgrade slirp4netns-debuginfoUpgrade podmanUpgrade crun-debugsourceUpgrade podman-plugins-debuginfoUpgrade criu-debuginfoUpgrade runc-debugsourceUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-debuginfoUpgrade runc-debuginfoUpgrade runcUpgrade skopeoUpgrade podman-remoteUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debugsourceUpgrade critUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade buildah-debuginfoUpgrade python3-criuUpgrade podman-remote-debuginfoUpgrade podman-debuginfoUpgrade podman-catatonitUpgrade buildah-tests-debuginfoUpgrade containers-common | May 5, 2022 | May 27, 2021 |
| Suse | — | Upgrade docker-kubic-bash-completionUpgrade runcUpgrade docker-fish-completionUpgrade docker-kubic-kubeadm-criconfigUpgrade docker-kubic-fish-completionUpgrade docker-bash-completionUpgrade containerdUpgrade docker-kubic-zsh-completionUpgrade containerd-ctrUpgrade dockerUpgrade docker-kubicUpgrade docker-zsh-completion | Jun 12, 2021 | May 14, 2021 |
| Ubuntu | — | Upgrade runcUpgrade runc (Ubuntu Pro) | May 20, 2021 | May 14, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub