runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade critUpgrade podman-remoteUpgrade python3-criuUpgrade podman-dockerUpgrade aardvark-dnsUpgrade buildahUpgrade toolbox-testsUpgrade container-selinuxUpgrade libslirpUpgrade buildah-testsUpgrade runcUpgrade udicaUpgrade podman-gvproxyUpgrade podman-testsUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade python3-podmanUpgrade crunUpgrade criu-libsUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonitUpgrade skopeo-testsUpgrade toolboxUpgrade fuse-overlayfsUpgrade skopeoUpgrade podman-pluginsUpgrade criu-develUpgrade netavarkUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade criuUpgrade conmonUpgrade podman | Nov 16, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | Mar 3, 2023 |
| Amazon Linux Ami 2 | — | Upgrade runc-debuginfoUpgrade runc | Jun 7, 2023 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade runc-debugsourceUpgrade runc-debuginfoUpgrade runc | Feb 17, 2025 | Feb 20, 2023 |
| Centos_linux | — | Upgrade criuUpgrade podman-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade buildahUpgrade cockpit-podmanUpgrade containernetworking-pluginsUpgrade podman-gvproxy-debuginfoUpgrade slirp4netnsUpgrade podman-remoteUpgrade skopeo-debuginfoUpgrade container-selinuxUpgrade runcUpgrade containernetworking-plugins-debuginfoUpgrade critUpgrade toolbox-debugsourceUpgrade libslirp-debuginfoUpgrade toolbox-testsUpgrade podman-pluginsUpgrade skopeoUpgrade podmanUpgrade podman-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade python3-criuUpgrade podman-debugsourceUpgrade slirp4netns-debuginfoUpgrade criu-libs-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade podman-gvproxyUpgrade crunUpgrade podman-dockerUpgrade udicaUpgrade skopeo-debugsourceUpgrade buildah-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-testsUpgrade fuse-overlayfsUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debugsourceUpgrade crun-debugsourceUpgrade runc-debugsourceUpgrade podman-catatonit-debuginfoUpgrade netavarkUpgrade crun-debuginfoUpgrade python3-podmanUpgrade runc-debuginfoUpgrade conmon-debugsourceUpgrade aardvark-dnsUpgrade criu-debuginfoUpgrade conmon-debuginfoUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade libslirpUpgrade criu-debugsourceUpgrade buildah-debugsourceUpgrade buildah-tests-debuginfoUpgrade criu-libsUpgrade podman-remote-debuginfoUpgrade criu-develUpgrade containers-commonUpgrade conmonUpgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolbox | Nov 8, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade runc | Mar 29, 2023 | Mar 3, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | May 9, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Jan 10, 2024 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade podman-dockerUpgrade slirp4netnsUpgrade container-selinuxUpgrade crunUpgrade containernetworking-pluginsUpgrade podman-pluginsUpgrade critUpgrade criu-develUpgrade udicaUpgrade skopeo-testsUpgrade python3-criuUpgrade runcUpgrade podman-gvproxyUpgrade podman-remoteUpgrade podman-testsUpgrade criu-libsUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade skopeoUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade podmanUpgrade containers-commonUpgrade netavarkUpgrade cockpit-podmanUpgrade python3-podmanUpgrade libslirp-develUpgrade buildahUpgrade libslirpUpgrade criuUpgrade conmonUpgrade podman-catatonit | Jul 20, 2023 | Feb 20, 2023 |
| Redhat Openshift | — | Upgrade runc | Jun 26, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade podman-catatonit-debuginfoUpgrade skopeo-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debuginfoUpgrade buildah-debugsourceUpgrade podman-catatonitUpgrade toolbox-debuginfoUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade runcUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade netavarkUpgrade criu-libs-debuginfoUpgrade skopeoUpgrade toolbox-testsUpgrade toolboxUpgrade criu-debugsourceUpgrade buildahUpgrade conmon-debugsourceUpgrade podmanUpgrade podman-pluginsUpgrade toolbox-debugsourceNo solution existsUpgrade fuse-overlayfsUpgrade criuUpgrade crun-debugsourceUpgrade udicaUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debuginfoUpgrade runc-debuginfoUpgrade python3-criuUpgrade criu-libsUpgrade criu-develUpgrade crunUpgrade skopeo-testsUpgrade libslirpUpgrade slirp4netns-debuginfoUpgrade aardvark-dnsUpgrade criu-debuginfoUpgrade cockpit-podmanUpgrade containernetworking-plugins-debuginfoUpgrade container-selinuxUpgrade skopeo-debuginfoUpgrade conmon-debuginfoUpgrade containers-commonUpgrade python3-podmanUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade libslirp-debugsourceUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade podman-testsUpgrade fuse-overlayfs-debugsourceUpgrade crun-debuginfoUpgrade conmonUpgrade libslirp-develUpgrade podman-docker | Nov 8, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade critUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade crunUpgrade slirp4netns-debuginfoUpgrade criuUpgrade buildahUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-testsUpgrade runcUpgrade podman-gvproxy-debuginfoUpgrade criu-debugsourceUpgrade buildah-debugsourceUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade podman-remoteUpgrade python3-criuUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-pluginsUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade conmon-debuginfoUpgrade slirp4netns-debugsourceUpgrade containers-commonUpgrade podman-debugsourceUpgrade criu-libsUpgrade aardvark-dnsUpgrade podman-remote-debuginfoUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netnsUpgrade crun-debugsourceUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debuginfoUpgrade criu-develUpgrade conmonUpgrade podman-testsUpgrade buildah-debuginfoUpgrade podman-pluginsUpgrade netavarkUpgrade criu-debuginfoUpgrade libslirp | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade runc | Apr 4, 2023 | Mar 3, 2023 |
| Ubuntu | — | Upgrade runc (Ubuntu Pro)Upgrade runc | May 19, 2023 | Mar 3, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub