runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-podmanUpgrade aardvark-dnsUpgrade netavarkUpgrade slirp4netnsUpgrade podman-testsUpgrade cockpit-podmanUpgrade skopeoUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade containers-commonUpgrade buildahUpgrade libslirp-develUpgrade criu-libsUpgrade conmonUpgrade udicaUpgrade podmanUpgrade criuUpgrade containernetworking-pluginsUpgrade criu-develUpgrade container-selinuxUpgrade podman-remoteUpgrade podman-dockerUpgrade critUpgrade crunUpgrade python3-criuUpgrade podman-pluginsUpgrade skopeo-testsUpgrade toolbox-testsUpgrade podman-catatonitUpgrade runc | Nov 15, 2022 | May 17, 2022 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | May 17, 2022 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Apr 25, 2025 | May 17, 2022 |
| Amazon_linux_2023 | — | Upgrade runc-debuginfoUpgrade runc-debugsourceUpgrade runc | Feb 17, 2025 | May 13, 2022 |
| Centos_linux | — | Upgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-testsUpgrade slirp4netnsUpgrade libslirpUpgrade netavarkUpgrade containernetworking-plugins-debugsourceUpgrade podman-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade criu-develUpgrade conmon-debugsourceUpgrade runc-debuginfoUpgrade libslirp-develUpgrade toolboxUpgrade python3-podmanUpgrade crun-debuginfoUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade slirp4netns-debugsourceUpgrade buildah-debugsourceUpgrade libslirp-debugsourceUpgrade skopeo-testsUpgrade conmonUpgrade criuUpgrade udicaUpgrade podman-catatonitUpgrade skopeo-debuginfoUpgrade podman-dockerUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podmanUpgrade crunUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade skopeo-debugsourceUpgrade buildah-tests-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolbox-testsUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade containers-commonUpgrade podman-debuginfoUpgrade python3-criuUpgrade container-selinuxUpgrade cockpit-podmanUpgrade buildah-debuginfoUpgrade podman-debugsourceUpgrade libslirp-debuginfoUpgrade buildah-testsUpgrade podman-gvproxy-debuginfoUpgrade buildahUpgrade toolbox-debuginfoUpgrade runcUpgrade criu-debugsourceUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debugsourceUpgrade podman-remoteUpgrade podman-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade aardvark-dnsUpgrade critUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook | Nov 9, 2022 | May 17, 2022 |
| Debian | — | Upgrade runc | Mar 29, 2023 | May 17, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | May 17, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-engine | Aug 18, 2022 | May 17, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Nov 4, 2022 | May 17, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade docker-runc | Sep 14, 2022 | May 17, 2022 |
| Oracle_linux | — | Upgrade skopeoUpgrade conmonUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade netavarkUpgrade podman-testsUpgrade libslirpUpgrade python3-podmanUpgrade criu-develUpgrade podman-dockerUpgrade crunUpgrade skopeo-testsUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade podman-pluginsUpgrade criuUpgrade buildahUpgrade aardvark-dnsUpgrade runcUpgrade containernetworking-pluginsUpgrade udicaUpgrade criu-libsUpgrade podmanUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade buildah-testsUpgrade python3-criuUpgrade critUpgrade libslirp-develUpgrade container-selinuxUpgrade podman-remote | Nov 16, 2022 | May 13, 2022 |
| Redhat Openshift | — | Upgrade runc | Aug 11, 2022 | May 13, 2022 |
| Redhat_linux | — | Upgrade slirp4netns-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-catatonit-debuginfoUpgrade aardvark-dnsUpgrade runc-debuginfoUpgrade runc-debugsourceUpgrade buildah-debugsourceUpgrade criu-libsUpgrade fuse-overlayfs-debugsourceUpgrade podman-pluginsUpgrade criu-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debuginfoUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade netavarkUpgrade containers-commonUpgrade podman-debugsourceUpgrade skopeo-testsUpgrade python3-podmanUpgrade criu-debugsourceUpgrade crun-debugsourceUpgrade criu-develUpgrade container-selinuxUpgrade podman-plugins-debuginfoUpgrade toolboxUpgrade slirp4netns-debuginfoUpgrade criu-libs-debuginfoUpgrade critUpgrade fuse-overlayfsUpgrade buildahUpgrade toolbox-debugsourceUpgrade toolbox-testsUpgrade runcUpgrade toolbox-debuginfoUpgrade podmanUpgrade python3-criuUpgrade criuUpgrade skopeoUpgrade crunUpgrade conmon-debuginfoUpgrade skopeo-debuginfoUpgrade libslirpUpgrade conmon-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-debugsourceUpgrade buildah-debuginfoUpgrade podman-dockerUpgrade podman-catatonitNo solution existsUpgrade udicaUpgrade libslirp-debuginfoUpgrade buildah-testsUpgrade cockpit-podmanUpgrade podman-gvproxy-debuginfoUpgrade skopeo-debugsourceUpgrade podman-debuginfoUpgrade podman-gvproxyUpgrade containernetworking-pluginsUpgrade podman-testsUpgrade slirp4netnsUpgrade fuse-overlayfs-debuginfoUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon | Nov 9, 2022 | May 17, 2022 |
| Rocky_linux | — | Upgrade buildah-debuginfoUpgrade criu-libsUpgrade toolboxUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonit-debuginfoUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade conmonUpgrade containers-commonUpgrade runc-debuginfoUpgrade skopeoUpgrade netavarkUpgrade criu-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade slirp4netnsUpgrade skopeo-debuginfoUpgrade libslirp-develUpgrade podman-testsUpgrade crunUpgrade crun-debuginfoUpgrade podman-gvproxyUpgrade skopeo-debugsourceUpgrade buildahUpgrade conmon-debugsourceUpgrade libslirpUpgrade podman-pluginsUpgrade podman-remote-debuginfoUpgrade podman-debuginfoUpgrade criu-develUpgrade skopeo-testsUpgrade runc-debugsourceUpgrade podman-debugsourceUpgrade aardvark-dnsUpgrade runcUpgrade libslirp-debuginfoUpgrade critUpgrade buildah-testsUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonitUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade python3-criuUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade crun-debugsourceUpgrade criu-libs-debuginfoUpgrade criu-debugsourceUpgrade podman-plugins-debuginfoUpgrade podmanUpgrade slirp4netns-debuginfoUpgrade toolbox-testsUpgrade criuUpgrade toolbox-debugsourceUpgrade podman-remoteUpgrade toolbox-debuginfoUpgrade slirp4netns-debugsource | Mar 12, 2024 | May 17, 2022 |
| Suse | — | Upgrade kubevirt-container-diskUpgrade kubevirt-virt-operatorUpgrade kubevirt-testsUpgrade docker-kubic-fish-completionUpgrade dockerUpgrade docker-bash-completionUpgrade docker-kubicUpgrade containerdUpgrade docker-fish-completionUpgrade runcUpgrade kubevirt-virt-controllerUpgrade obs-service-kubevirt_containers_metaUpgrade kubevirt-virtctlUpgrade kubevirt-virt-launcherUpgrade containerd-ctrUpgrade docker-kubic-zsh-completionUpgrade docker-kubic-bash-completionUpgrade kubevirt-manifestsUpgrade kubevirt-virt-apiUpgrade docker-zsh-completionUpgrade docker-kubic-kubeadm-criconfigUpgrade kubevirt-virt-handler | Oct 26, 2022 | May 17, 2022 |
| Ubuntu | — | Upgrade runc (Ubuntu Pro) | May 24, 2023 | May 17, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 17, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub