runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade conmonUpgrade podman-catatonitUpgrade python3-podmanUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade fuse-overlayfsUpgrade criuUpgrade crunUpgrade containers-commonUpgrade criu-libsUpgrade skopeoUpgrade criu-develUpgrade podmanUpgrade podman-pluginsUpgrade netavarkUpgrade libslirp-develUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade podman-remoteUpgrade buildah-testsUpgrade container-selinuxUpgrade podman-gvproxyUpgrade python3-criuUpgrade podman-dockerUpgrade cockpit-podmanUpgrade buildahUpgrade critUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade udicaUpgrade runcUpgrade toolbox-testsUpgrade podman-tests | Nov 16, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | Mar 3, 2023 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Jun 7, 2023 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade runcUpgrade runc-debuginfoUpgrade runc-debugsource | Feb 17, 2025 | Feb 20, 2023 |
| Centos_linux | — | Upgrade criu-debugsourceUpgrade buildah-debugsourceUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade libslirp-develUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade conmonUpgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade podman-remote-debuginfoUpgrade containers-commonUpgrade slirp4netns-debugsourceUpgrade criu-develUpgrade crun-debuginfoUpgrade python3-podmanUpgrade netavarkUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade criu-libsUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolboxUpgrade conmon-debuginfoUpgrade aardvark-dnsUpgrade skopeo-testsUpgrade criuUpgrade podman-remoteUpgrade toolbox-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade toolbox-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netns-debuginfoUpgrade skopeo-debuginfoUpgrade skopeo-debugsourceUpgrade podman-testsUpgrade buildah-testsUpgrade udicaUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade buildahUpgrade skopeoUpgrade runcUpgrade podman-pluginsUpgrade podman-gvproxy-debuginfoUpgrade fuse-overlayfsUpgrade container-selinuxUpgrade slirp4netnsUpgrade podman-dockerUpgrade libslirp-debugsourceUpgrade crunUpgrade podmanUpgrade python3-criuUpgrade podman-gvproxyUpgrade toolbox-tests | Nov 8, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade runc | Mar 29, 2023 | Mar 3, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | May 9, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Jan 10, 2024 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade netavarkUpgrade conmonUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade buildahUpgrade python3-podmanUpgrade libslirp-develUpgrade podmanUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade criu-libsUpgrade libslirpUpgrade skopeoUpgrade criuUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade python3-criuUpgrade podman-gvproxyUpgrade podman-dockerUpgrade udicaUpgrade criu-develUpgrade podman-pluginsUpgrade podman-testsUpgrade critUpgrade skopeo-testsUpgrade runcUpgrade crunUpgrade slirp4netns | Jul 20, 2023 | Feb 20, 2023 |
| Redhat Openshift | — | Upgrade runc | Jun 26, 2023 | Mar 3, 2023 |
| Redhat_linux | — | Upgrade podman-remote-debuginfoUpgrade criuUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade buildahUpgrade skopeoUpgrade criu-libs-debuginfoUpgrade skopeo-debugsourceUpgrade podman-catatonit-debuginfoUpgrade podmanUpgrade toolbox-debugsourceUpgrade toolboxUpgrade udicaUpgrade crun-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-pluginsNo solution existsUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade critUpgrade conmon-debugsourceUpgrade buildah-debugsourceUpgrade toolbox-testsUpgrade podman-debuginfoUpgrade runcUpgrade podman-gvproxy-debuginfoUpgrade netavarkUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-catatonitUpgrade conmon-debuginfoUpgrade libslirp-develUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-testsUpgrade podman-gvproxyUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade buildah-testsUpgrade podman-plugins-debuginfoUpgrade buildah-tests-debuginfoUpgrade slirp4netnsUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-debugsourceUpgrade podman-debugsourceUpgrade skopeo-debuginfoUpgrade container-selinuxUpgrade conmonUpgrade criu-debuginfoUpgrade crun-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade libslirpUpgrade python3-podmanUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade crunUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade podman-dockerUpgrade criu-develUpgrade python3-criuUpgrade runc-debuginfoUpgrade criu-libsUpgrade containers-common | Nov 8, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade crunUpgrade slirp4netns-debuginfoUpgrade libslirp-debugsourceUpgrade criu-debugsourceUpgrade fuse-overlayfsUpgrade podman-gvproxy-debuginfoUpgrade critUpgrade buildah-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade criuUpgrade containernetworking-pluginsUpgrade buildahUpgrade podman-debuginfoUpgrade runcUpgrade criu-libs-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podmanUpgrade runc-debugsourceUpgrade python3-criuUpgrade libslirp-debuginfoUpgrade podman-remoteUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade buildah-debugsourceUpgrade criu-libsUpgrade slirp4netns-debugsourceUpgrade aardvark-dnsUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade buildah-debuginfoUpgrade crun-debuginfoUpgrade criu-develUpgrade conmonUpgrade podman-remote-debuginfoUpgrade conmon-debugsourceUpgrade podman-testsUpgrade slirp4netnsUpgrade crun-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxyUpgrade podman-debugsourceUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade libslirpUpgrade containers-commonUpgrade podman-plugins | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade runc | Apr 4, 2023 | Mar 3, 2023 |
| Ubuntu | — | Upgrade runc (Ubuntu Pro)Upgrade runc | May 19, 2023 | Mar 3, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub