runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade containers-commonUpgrade podman-catatonitUpgrade toolboxUpgrade skopeoUpgrade skopeo-testsUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade criuUpgrade python3-podmanUpgrade crunUpgrade libslirp-develUpgrade podmanUpgrade criu-develUpgrade python3-criuUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade podman-remoteUpgrade aardvark-dnsUpgrade udicaUpgrade critUpgrade container-selinuxUpgrade podman-dockerUpgrade toolbox-testsUpgrade podman-testsUpgrade runcUpgrade libslirpUpgrade buildahUpgrade buildah-testsUpgrade slirp4netns | Nov 16, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | Mar 3, 2023 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Jun 7, 2023 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade runc-debuginfoUpgrade runcUpgrade runc-debugsource | Feb 17, 2025 | Feb 20, 2023 |
| Centos_linux | — | Upgrade fuse-overlayfs-debugsourceUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-develUpgrade runc-debuginfoUpgrade crun-debugsourceUpgrade python3-podmanUpgrade crun-debuginfoUpgrade netavarkUpgrade libslirpUpgrade podman-remote-debuginfoUpgrade slirp4netns-debugsourceUpgrade criu-develUpgrade buildah-debuginfoUpgrade conmonUpgrade skopeo-testsUpgrade conmon-debugsourceUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonit-debuginfoUpgrade runc-debugsourceUpgrade buildah-debugsourceUpgrade criu-debugsourceUpgrade criu-libsUpgrade fuse-overlayfsUpgrade criu-libs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade podman-testsUpgrade skopeo-debugsourceUpgrade buildah-testsUpgrade podman-catatonitUpgrade containernetworking-plugins-debugsourceUpgrade criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade buildahUpgrade podman-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade podman-remoteUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade skopeo-debuginfoUpgrade toolbox-testsUpgrade toolbox-debugsourceUpgrade libslirp-debugsourceUpgrade udicaUpgrade skopeoUpgrade slirp4netnsUpgrade runcUpgrade podman-dockerUpgrade container-selinuxUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade slirp4netns-debuginfoUpgrade podmanUpgrade python3-criu | Nov 8, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade runc | Mar 29, 2023 | Mar 3, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | May 9, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Jan 10, 2024 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade python3-podmanUpgrade libslirp-develUpgrade buildah-testsUpgrade criu-libsUpgrade criuUpgrade fuse-overlayfsUpgrade libslirpUpgrade podmanUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonitUpgrade skopeoUpgrade conmonUpgrade aardvark-dnsUpgrade buildahUpgrade cockpit-podmanUpgrade netavarkUpgrade criu-develUpgrade skopeo-testsUpgrade podman-dockerUpgrade udicaUpgrade crunUpgrade runcUpgrade python3-criuUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade podman-pluginsUpgrade critUpgrade podman-testsUpgrade slirp4netnsUpgrade container-selinuxUpgrade podman-gvproxy | Jul 20, 2023 | Feb 20, 2023 |
| Redhat Openshift | — | Upgrade runc | Jun 26, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade podman-gvproxyUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netnsUpgrade libslirp-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-debugsourceUpgrade conmon-debuginfoUpgrade python3-criuUpgrade criu-libsUpgrade criu-debuginfoUpgrade libslirpUpgrade criu-develUpgrade crun-debuginfoUpgrade aardvark-dnsUpgrade buildah-testsUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade python3-podmanUpgrade podman-testsUpgrade skopeo-testsUpgrade podman-dockerUpgrade cockpit-podmanUpgrade podman-plugins-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade libslirp-develUpgrade crunUpgrade skopeo-debuginfoUpgrade slirp4netns-debuginfoUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade podmanUpgrade toolbox-debugsourceUpgrade skopeo-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade conmon-debugsourceUpgrade toolboxUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade podman-catatonitUpgrade skopeoUpgrade crun-debugsourceUpgrade udicaUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonit-debuginfoUpgrade criu-libs-debuginfoUpgrade buildah-debugsourceUpgrade runcUpgrade buildah-debuginfoUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade podman-remote-debuginfoUpgrade podman-remoteUpgrade criuUpgrade fuse-overlayfsUpgrade podman-debuginfoUpgrade critUpgrade netavarkUpgrade toolbox-testsUpgrade buildahUpgrade fuse-overlayfs-debuginfoNo solution existsUpgrade podman-plugins | Nov 8, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade aardvark-dnsUpgrade netavarkUpgrade conmon-debuginfoUpgrade containers-commonUpgrade podman-debugsourceUpgrade criu-debuginfoUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade libslirpUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade buildah-tests-debuginfoUpgrade conmon-debugsourceUpgrade criu-libsUpgrade containernetworking-plugins-debugsourceUpgrade crun-debugsourceUpgrade conmonUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade crun-debuginfoUpgrade criu-develUpgrade buildah-debuginfoUpgrade runc-debuginfoUpgrade podman-testsUpgrade buildah-testsUpgrade podman-catatonitUpgrade podman-catatonit-debuginfoUpgrade podman-debuginfoUpgrade critUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debugsourceUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade containernetworking-pluginsUpgrade buildahUpgrade runc-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade criuUpgrade podmanUpgrade libslirp-debuginfoUpgrade podman-remoteUpgrade python3-criuUpgrade crunUpgrade slirp4netns-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-plugins-debuginfoUpgrade runcUpgrade oci-seccomp-bpf-hook-debuginfo | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade runc | Apr 4, 2023 | Mar 3, 2023 |
| Ubuntu | — | Upgrade runc (Ubuntu Pro)Upgrade runc | May 19, 2023 | Mar 3, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub