runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-criuUpgrade udicaUpgrade libslirpUpgrade podman-dockerUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade runcUpgrade critUpgrade buildah-testsUpgrade podman-remoteUpgrade container-selinuxUpgrade buildahUpgrade cockpit-podmanUpgrade toolbox-testsUpgrade podman-testsUpgrade netavarkUpgrade skopeoUpgrade criu-develUpgrade podman-catatonitUpgrade libslirp-develUpgrade conmonUpgrade toolboxUpgrade criuUpgrade python3-podmanUpgrade skopeo-testsUpgrade criu-libsUpgrade podman-pluginsUpgrade containers-commonUpgrade fuse-overlayfsUpgrade crunUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade podman | Nov 16, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | Mar 3, 2023 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Jun 7, 2023 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade runc-debuginfoUpgrade runcUpgrade runc-debugsource | Feb 17, 2025 | Feb 20, 2023 |
| Centos_linux | — | Upgrade container-selinuxUpgrade skopeoUpgrade slirp4netnsUpgrade skopeo-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade crunUpgrade libslirp-debuginfoUpgrade podman-debugsourceUpgrade critUpgrade podman-debuginfoUpgrade cockpit-podmanUpgrade containernetworking-plugins-debuginfoUpgrade runcUpgrade containernetworking-pluginsUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-catatonitUpgrade libslirp-debugsourceUpgrade criuUpgrade podman-testsUpgrade skopeo-debugsourceUpgrade buildah-testsUpgrade udicaUpgrade slirp4netns-debuginfoUpgrade podman-remoteUpgrade containernetworking-plugins-debugsourceUpgrade podman-plugins-debuginfoUpgrade toolbox-testsUpgrade podman-gvproxyUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade podmanUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-debuginfoUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade criu-debuginfoUpgrade conmon-debuginfoUpgrade criu-debugsourceUpgrade libslirpUpgrade buildah-debugsourceUpgrade criu-libsUpgrade toolboxUpgrade runc-debugsourceUpgrade containers-commonUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade netavarkUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade buildah-tests-debuginfoUpgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade aardvark-dnsUpgrade python3-podmanUpgrade buildah-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-develUpgrade conmon | Nov 8, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade runc | Mar 29, 2023 | Mar 3, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | May 9, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Jan 10, 2024 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade podman-pluginsUpgrade critUpgrade criu-develUpgrade podman-testsUpgrade crunUpgrade udicaUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade podman-remoteUpgrade podman-dockerUpgrade slirp4netnsUpgrade container-selinuxUpgrade runcUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade skopeoUpgrade podman-catatonitUpgrade netavarkUpgrade cockpit-podmanUpgrade conmonUpgrade libslirpUpgrade criuUpgrade libslirp-develUpgrade podmanUpgrade buildahUpgrade python3-podmanUpgrade buildah-testsUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade fuse-overlayfs | Jul 20, 2023 | Feb 20, 2023 |
| Redhat Openshift | — | Upgrade runc | Jun 26, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade podmanUpgrade toolbox-debugsourceUpgrade fuse-overlayfsUpgrade criu-libs-debuginfoUpgrade skopeoUpgrade podman-catatonit-debuginfoUpgrade runcUpgrade toolboxUpgrade criu-debugsourceUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade netavarkUpgrade podman-catatonitUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade conmon-debugsourceNo solution existsUpgrade udicaUpgrade criuUpgrade buildah-debuginfoUpgrade podman-debuginfoUpgrade toolbox-testsUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade skopeo-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-remoteUpgrade critUpgrade podman-pluginsUpgrade crunUpgrade crun-debuginfoUpgrade libslirp-debugsourceUpgrade skopeo-debuginfoUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade containernetworking-plugins-debuginfoUpgrade cockpit-podmanUpgrade python3-podmanUpgrade container-selinuxUpgrade libslirpUpgrade criu-debuginfoUpgrade runc-debuginfoUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-plugins-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade buildah-testsUpgrade buildah-tests-debuginfoUpgrade criu-develUpgrade criu-libsUpgrade fuse-overlayfs-debugsourceUpgrade conmonUpgrade podman-testsUpgrade containers-commonUpgrade podman-dockerUpgrade conmon-debuginfoUpgrade python3-criuUpgrade aardvark-dnsUpgrade podman-gvproxyUpgrade libslirp-devel | Nov 8, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade crun-debuginfoUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade criu-libsUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-debugsourceUpgrade criu-develUpgrade conmonUpgrade containers-commonUpgrade netavarkUpgrade podman-pluginsUpgrade libslirpUpgrade slirp4netnsUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade slirp4netns-debugsourceUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade conmon-debugsourceUpgrade podman-testsUpgrade crun-debugsourceUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade runc-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade buildah-testsUpgrade runcUpgrade python3-criuUpgrade podman-remoteUpgrade podman-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade buildah-debugsourceUpgrade criuUpgrade buildahUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debuginfoUpgrade criu-debugsourceUpgrade critUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns-debuginfoUpgrade crunUpgrade criu-libs-debuginfoUpgrade podman-catatonitUpgrade podmanUpgrade libslirp-debuginfo | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade runc | Apr 4, 2023 | Mar 3, 2023 |
| Ubuntu | — | Upgrade runcUpgrade runc (Ubuntu Pro) | May 19, 2023 | Mar 3, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub