Runc Integer Overflow DoS

🗓️ 17 May 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 18 Views

Runc container tool has an integer overflow allowing attackers to access data, compromise integrity, and disrupt services.

Reporter	Title	Published	Views	Family All 105
ALT Linux	Security fix for the ALT Linux 10 package runc version 1.0.3-alt1	17 Dec 202100:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202316:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	25 Sep 202516:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	18 May 202613:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	26 Mar 202503:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	15 Apr 202503:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to several issues due to the go compiler	8 Aug 202414:17	–	ibm
attackerkb	CVE-2021-43784	6 Dec 202118:15	–	attackerkb
AlpineLinux	CVE-2021-43784	6 Dec 202100:00	–	alpinelinux
AlmaLinux	Moderate: runc security update	7 Nov 202300:00	–	almalinux

Vulners

Node

docker runcRange<1.0.3

Source	Link
bugs	www.bugs.chromium.org/p/project-zero/issues/detail
github	www.github.com/opencontainers/runc/commit/9c444070ec7bb83995dbc0185da68284da71c554
github	www.github.com/opencontainers/runc/commit/d72d057ba794164c3cce9451a00b72a78b25e1ae
github	www.github.com/opencontainers/runc/commit/f50369af4b571e358f20b139eea52d612eb55eed
github	www.github.com/opencontainers/runc/security/advisories/GHSA-v95c-p5hm-xq8f
lists	www.lists.debian.org/debian-lts-announce/2021/12/msg00005.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-43784
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-43784
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17
openwall	www.openwall.com/lists/oss-security/2021/12/06/1

09 Nov 2023 00:00Current

7High risk

Vulners AI Score7

CVSS 35

CVSS 26

EPSS0.01803

runc vulnerability integer overflow remote attack data access service disruption integrity breach