runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade crunUpgrade toolboxUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade criuUpgrade criu-libsUpgrade skopeoUpgrade netavarkUpgrade python3-podmanUpgrade libslirp-develUpgrade containers-commonUpgrade conmonUpgrade criu-develUpgrade aardvark-dnsUpgrade runcUpgrade cockpit-podmanUpgrade podman-remoteUpgrade podman-gvproxyUpgrade toolbox-testsUpgrade container-selinuxUpgrade podman-testsUpgrade udicaUpgrade buildah-testsUpgrade critUpgrade slirp4netnsUpgrade python3-criuUpgrade podman-dockerUpgrade libslirpUpgrade buildah | Nov 16, 2023 | Mar 3, 2023 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | Mar 3, 2023 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Jun 7, 2023 | Mar 3, 2023 |
| Amazon_linux_2023 | — | Upgrade runc-debugsourceUpgrade runc-debuginfoUpgrade runc | Feb 17, 2025 | Feb 20, 2023 |
| Centos_linux | — | Upgrade runc-debugsourceUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonit-debuginfoUpgrade toolboxUpgrade criu-libsUpgrade conmon-debugsourceUpgrade conmon-debuginfoUpgrade aardvark-dnsUpgrade fuse-overlayfs-debugsourceUpgrade python3-podmanUpgrade criu-develUpgrade containers-commonUpgrade conmonUpgrade libslirp-develUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade skopeo-testsUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade netavarkUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade criu-debugsourceUpgrade libslirpUpgrade slirp4netns-debugsourceUpgrade crun-debuginfoUpgrade skopeoUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade podman-gvproxy-debuginfoUpgrade container-selinuxUpgrade podman-testsUpgrade buildah-testsUpgrade skopeo-debugsourceUpgrade runcUpgrade toolbox-testsUpgrade podman-debuginfoUpgrade toolbox-debugsourceUpgrade podman-debugsourceUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade buildahUpgrade toolbox-debuginfoUpgrade podman-plugins-debuginfoUpgrade criuUpgrade skopeo-debuginfoUpgrade podman-remoteUpgrade podman-dockerUpgrade podmanUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade podman-gvproxyUpgrade libslirp-debugsourceUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade udicaUpgrade podman-plugins | Nov 8, 2023 | Mar 3, 2023 |
| Debian | — | Upgrade runc | Mar 29, 2023 | Mar 3, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-runc | May 9, 2023 | Mar 3, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Jan 10, 2024 | Mar 3, 2023 |
| Oracle_linux | — | Upgrade criu-develUpgrade crunUpgrade critUpgrade podman-pluginsUpgrade udicaUpgrade podman-dockerUpgrade podman-remoteUpgrade podman-testsUpgrade runcUpgrade podman-gvproxyUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade slirp4netnsUpgrade container-selinuxUpgrade libslirp-develUpgrade python3-podmanUpgrade cockpit-podmanUpgrade buildahUpgrade skopeoUpgrade netavarkUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade containers-commonUpgrade libslirpUpgrade criuUpgrade podmanUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade criu-libsUpgrade buildah-tests | Jul 20, 2023 | Feb 20, 2023 |
| Redhat Openshift | — | Upgrade runc | Jun 26, 2023 | Feb 20, 2023 |
| Redhat_linux | — | Upgrade podman-gvproxy-debuginfoUpgrade toolbox-testsUpgrade netavarkUpgrade toolboxUpgrade podman-debuginfoUpgrade criu-debugsourceUpgrade podman-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade crun-debugsourceUpgrade criuUpgrade podmanNo solution existsUpgrade toolbox-debuginfoUpgrade buildahUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade udicaUpgrade critUpgrade conmon-debugsourceUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-debugsourceUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade toolbox-debugsourceUpgrade podman-remote-debuginfoUpgrade buildah-debuginfoUpgrade skopeo-debugsourceUpgrade podman-catatonit-debuginfoUpgrade criu-libs-debuginfoUpgrade runcUpgrade criu-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-dockerUpgrade crunUpgrade buildah-tests-debuginfoUpgrade podman-debugsourceUpgrade libslirp-debugsourceUpgrade crun-debuginfoUpgrade python3-criuUpgrade libslirp-develUpgrade python3-podmanUpgrade runc-debuginfoUpgrade skopeo-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade buildah-testsUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debuginfoUpgrade containers-commonUpgrade libslirpUpgrade podman-testsUpgrade criu-libsUpgrade conmonUpgrade criu-develUpgrade container-selinuxUpgrade aardvark-dnsUpgrade runc-debugsourceUpgrade cockpit-podmanUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-testsUpgrade slirp4netns-debuginfo | Nov 8, 2023 | Mar 3, 2023 |
| Rocky_linux | — | Upgrade podman-plugins-debuginfoUpgrade podman-catatonitUpgrade podman-catatonit-debuginfoUpgrade buildah-debugsourceUpgrade critUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade criuUpgrade runc-debugsourceUpgrade buildahUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podmanUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade crunUpgrade buildah-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runcUpgrade podman-remoteUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netns-debuginfoUpgrade aardvark-dnsUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-develUpgrade runc-debuginfoUpgrade podman-remote-debuginfoUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade slirp4netns-debugsourceUpgrade crun-debugsourceUpgrade containers-commonUpgrade podman-pluginsUpgrade libslirpUpgrade oci-seccomp-bpf-hookUpgrade podman-debugsourceUpgrade conmon-debuginfoUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debuginfoUpgrade conmonUpgrade netavarkUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade podman-testsUpgrade conmon-debugsource | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade runc | Apr 4, 2023 | Mar 3, 2023 |
| Ubuntu | — | Upgrade runc (Ubuntu Pro)Upgrade runc | May 19, 2023 | Mar 3, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub