runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirpUpgrade slirp4netnsUpgrade python3-criuUpgrade udicaUpgrade container-selinuxUpgrade podman-testsUpgrade podman-dockerUpgrade buildah-testsUpgrade runcUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade podman-remoteUpgrade podman-gvproxyUpgrade critUpgrade toolbox-testsUpgrade buildahUpgrade skopeo-testsUpgrade python3-podmanUpgrade toolboxUpgrade criu-libsUpgrade podmanUpgrade criu-develUpgrade containernetworking-pluginsUpgrade crunUpgrade fuse-overlayfsUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonitUpgrade conmonUpgrade libslirp-develUpgrade containers-commonUpgrade skopeoUpgrade criuUpgrade netavark | Nov 16, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | Mar 3, 2023 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Jun 7, 2023 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade runc-debugsourceUpgrade runcUpgrade runc-debuginfo | Feb 17, 2025 | Feb 20, 2023 |
| Centos_linux | — | Upgrade containers-commonUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade conmon-debugsourceUpgrade libslirp-develUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonit-debuginfoUpgrade runc-debugsourceUpgrade toolboxUpgrade buildah-debugsourceUpgrade criu-libsUpgrade skopeo-testsUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirpUpgrade crun-debuginfoUpgrade netavarkUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade conmonUpgrade python3-podmanUpgrade buildah-tests-debuginfoUpgrade crun-debugsourceUpgrade aardvark-dnsUpgrade conmon-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-debuginfoUpgrade podman-testsUpgrade podman-gvproxy-debuginfoUpgrade podman-dockerUpgrade toolbox-testsUpgrade toolbox-debugsourceUpgrade skopeo-debugsourceUpgrade podman-debuginfoUpgrade buildah-testsUpgrade slirp4netnsUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade podmanUpgrade python3-criuUpgrade podman-gvproxyUpgrade libslirp-debugsourceUpgrade slirp4netns-debuginfoUpgrade udicaUpgrade podman-catatonitUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade toolbox-debuginfoUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criuUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade buildahUpgrade skopeo-debuginfoUpgrade podman-remoteUpgrade skopeoUpgrade runcUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade container-selinuxUpgrade cockpit-podmanUpgrade podman-debugsource | Nov 8, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade runc | Mar 29, 2023 | Mar 3, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | May 9, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Jan 10, 2024 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade crunUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade python3-criuUpgrade podman-dockerUpgrade udicaUpgrade container-selinuxUpgrade slirp4netnsUpgrade runcUpgrade podman-testsUpgrade critUpgrade podman-pluginsUpgrade criu-develUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade netavarkUpgrade libslirpUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade skopeoUpgrade podman-catatonitUpgrade criuUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade buildah-testsUpgrade libslirp-develUpgrade python3-podmanUpgrade containers-commonUpgrade buildahUpgrade podmanUpgrade conmon | Jul 20, 2023 | Feb 20, 2023 |
| Redhat Openshift | — | Upgrade runc | Jun 26, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade podman-remote-debuginfoUpgrade netavarkUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade toolboxUpgrade podman-gvproxy-debuginfoUpgrade toolbox-testsUpgrade buildah-debuginfoUpgrade libslirp-debuginfoUpgrade crun-debugsourceUpgrade runcUpgrade criu-libs-debuginfoUpgrade critUpgrade podman-catatonit-debuginfoNo solution existsUpgrade podmanUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade podman-pluginsUpgrade criuUpgrade skopeo-debugsourceUpgrade podman-catatonitUpgrade toolbox-debuginfoUpgrade udicaUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-debugsourceUpgrade buildah-debugsourceUpgrade conmon-debugsourceUpgrade fuse-overlayfsUpgrade skopeoUpgrade conmonUpgrade podman-testsUpgrade crun-debuginfoUpgrade libslirpUpgrade fuse-overlayfs-debugsourceUpgrade criu-debuginfoUpgrade container-selinuxUpgrade cockpit-podmanUpgrade python3-podmanUpgrade containernetworking-plugins-debuginfoUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-debugsourceUpgrade slirp4netns-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-debugsourceUpgrade slirp4netns-debuginfoUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade runc-debuginfoUpgrade podman-dockerUpgrade crunUpgrade skopeo-testsUpgrade podman-plugins-debuginfoUpgrade buildah-testsUpgrade python3-criuUpgrade conmon-debuginfoUpgrade skopeo-debuginfoUpgrade aardvark-dnsUpgrade containers-commonUpgrade libslirp-devel | Nov 8, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade criuUpgrade runc-debugsourceUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade buildahUpgrade runcUpgrade podman-gvproxy-debuginfoUpgrade criu-libs-debuginfoUpgrade crunUpgrade buildah-testsUpgrade libslirp-debuginfoUpgrade podmanUpgrade podman-catatonit-debuginfoUpgrade podman-remoteUpgrade podman-catatonitUpgrade podman-plugins-debuginfoUpgrade buildah-debugsourceUpgrade python3-criuUpgrade podman-debuginfoUpgrade critUpgrade criu-debugsourceUpgrade fuse-overlayfsUpgrade libslirp-debugsourceUpgrade criu-libsUpgrade fuse-overlayfs-debugsourceUpgrade podman-gvproxyUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade containers-commonUpgrade podman-pluginsUpgrade netavarkUpgrade libslirpUpgrade buildah-debuginfoUpgrade podman-remote-debuginfoUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debugsourceUpgrade podman-testsUpgrade crun-debugsourceUpgrade libslirp-develUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade conmonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debuginfoUpgrade criu-develUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade runc | Apr 4, 2023 | Mar 3, 2023 |
| Ubuntu | — | Upgrade runcUpgrade runc (Ubuntu Pro) | May 19, 2023 | Mar 3, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub