Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
gentooGentoo FoundationGLSA-202003-21
HistoryMar 15, 2020 - 12:00 a.m.

runC: Multiple vulnerabilities

2020-03-1500:00:00
Gentoo Foundation
security.gentoo.org
125

8.6 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

74.6%

JSON

Background

RunC is a CLI tool for spawning and running containers according to the OCI specification.

Description

Multiple vulnerabilities have been discovered in runC. Please review the CVE identifiers referenced below for details.

Impact

An attacker, by running a malicious Docker image, could escape the container, bypass security restrictions, escalate privileges or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All runC users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-emulation/runc-1.0.0_rc10"
OSVersionArchitecturePackageVersionFilename
Gentooanyallapp-emulation/runc< 1.0.0_rc10UNKNOWN

Related

nessus 53
fedora 13
openvas 37
ubuntu 1
oraclelinux 3
debian 2
cve 3
alpinelinux 2
osv 7
redhatcve 2
prion 3
altlinux 3
veracode 2
redhat 11
suse 8
debiancve 2
amazon 3
mageia 3
photon 4
github 2
ubuntucve 2
cbl_mariner 2
ibm 4
impervablog 1
githubexploit 4
hackerone 3
zdt 2
threatpost 3
vmware 2
f5 1
exploitpack 1
virtuozzo 1
thn 2
kitploit 1
almalinux 1
archlinux 2
trendmicroblog 2
qualysblog 1
nessus
nessus
GLSA-202003-21 : runC: Multiple vulnerabilities
2020-03-16 00:00:00
Ubuntu 18.04 LTS : runC vulnerabilities (USN-4297-1)
2020-03-10 00:00:00
Debian DLA-3369-1 : runc - LTS security update
2023-03-28 00:00:00
fedora
fedora
[SECURITY] Fedora 30 Update: runc-1.0.0-102.dev.gitdc9208a.fc30
2020-02-08 01:40:01
[SECURITY] Fedora 31 Update: runc-1.0.0-102.dev.gitdc9208a.fc31
2020-02-08 02:05:47
[SECURITY] Fedora 31 Update: runc-1.0.0-101.rc9.gitc1485a1.fc31
2019-10-08 00:30:40
openvas
openvas
Fedora: Security Advisory for runc (FEDORA-2020-b2c1f6cc75)
2020-02-08 00:00:00
Ubuntu: Security Advisory (USN-4297-1)
2020-03-10 00:00:00
Huawei EulerOS: Security Advisory for docker-engine (EulerOS-SA-2023-1617)
2023-04-13 00:00:00
ubuntu
ubuntu
runC vulnerabilities
2020-03-09 00:00:00
oraclelinux
oraclelinux
container-tools:ol8 security, bug fix, and enhancement update
2020-08-06 00:00:00
runc bug fix update
2021-04-28 00:00:00
container-tools:rhel8 security and bug fix update
2019-07-30 00:00:00
debian
debian
[SECURITY] [DLA 3369-1] runc security update
2023-03-27 16:07:07
[SECURITY] [DLA 3322-1] golang-github-opencontainers-selinux security update
2023-02-18 17:16:16
cve
cve
CVE-2019-19921
2020-02-12 15:15:00
CVE-2019-16884
2019-09-25 18:15:00
CVE-2019-5736
2019-02-11 19:29:00
alpinelinux
alpinelinux
CVE-2019-19921
2020-02-12 15:15:00
CVE-2019-16884
2019-09-25 18:15:00
osv
osv
opencontainers runc contains procfs race condition with a shared volume mount
2021-05-27 18:41:17
Race condition in github.com/opencontainers/runc
2021-04-14 20:04:52
CVE-2019-19921
2020-02-12 15:15:12
redhatcve
redhatcve
CVE-2019-19921
2020-01-29 16:31:25
CVE-2019-5736
2020-01-11 09:33:43
prion
prion
Improper access control
2020-02-12 15:15:00
Design/Logic Flaw
2019-09-25 18:15:00
Design/Logic Flaw
2019-02-11 19:29:00
altlinux
altlinux
Security fix for the ALT Linux 10 package runc version 1.0.0-alt12.rc10
2020-02-17 00:00:00
Security fix for the ALT Linux 10 package runc version 1.0.0-alt10.rc9
2019-10-10 00:00:00
Security fix for the ALT Linux 8 package runc version 1.0.0-alt7.git0a012df
2019-02-20 00:00:00
veracode
veracode
Sandbox Restrictions Bypass
2020-01-16 05:48:35
Malicious Container Execution
2019-02-12 02:31:29
redhat
redhat
(RHSA-2020:0942) Moderate: runc security update
2020-03-23 13:32:09
(RHSA-2020:0688) Moderate: OpenShift Container Platform 4.2.22 runc security update
2020-03-10 12:10:03
(RHSA-2020:1485) Moderate: OpenShift Container Platform 4.3.13 runc security update
2020-04-20 17:07:18
suse
suse
Security update for docker-runc (moderate)
2019-10-31 00:00:00
Security update for docker-runc (moderate)
2020-02-13 00:00:00
Security update for docker-runc (moderate)
2019-11-05 00:00:00
debiancve
debiancve
CVE-2019-16884
2019-09-25 18:15:00
CVE-2019-19921
2020-02-12 15:15:00
amazon
amazon
Medium: runc
2020-04-20 18:58:00
Important: runc
2021-12-28 23:55:00
Important: docker
2019-02-08 22:28:00
mageia
mageia
Updated opencontainers-runc packages fix security vulnerability
2020-02-26 13:21:01
Updated opencontainers-runc packages fix security vulnerability
2019-02-13 14:08:25
Updated lxc packages fix security vulnerability
2019-02-17 03:31:02
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0275
2020-08-22 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0241
2020-05-09 00:00:00
Important Photon OS Security Update - PHSA-2019-0001
2019-02-12 00:00:00
github
github
opencontainers runc contains procfs race condition with a shared volume mount
2021-05-27 18:41:17
Incorrect Authorization in runc
2022-02-22 15:38:08
ubuntucve
ubuntucve
CVE-2019-19921
2020-02-12 00:00:00
CVE-2019-5736
2019-02-11 00:00:00
cbl_mariner
cbl_mariner
CVE-2019-16884 affecting package moby-buildx 0.4.1-3
2021-07-08 21:56:42
CVE-2019-5736 affecting package moby-buildx 0.4.1-3
2021-07-08 21:56:42
ibm
ibm
Security Bulletin: IBM Cloud Private for Data is affected by an issue with runc used by Docker
2019-10-03 22:50:40
Security Bulletin: IBM Cloud Functions is affected by a privilege escalation vulnerability in runc
2019-02-18 20:15:01
Security Bulletin: IBM API Connect is affected by a critical vulnerability in Kubernetes via runc (CVE-2019-5736)
2019-03-05 17:05:02
impervablog
impervablog
Hundreds of Vulnerable Docker Hosts Exploited by Cryptocurrency Miners
2019-03-04 21:00:39
githubexploit
githubexploit
Exploit for OS Command Injection in Docker
2019-06-30 13:42:14
Exploit for OS Command Injection in Docker
2019-12-12 16:57:13
Exploit for OS Command Injection in Docker
2021-07-08 22:46:30
hackerone
hackerone
Internet Bug Bounty: CVE-2019-5736: Escape from Docker and Kubernetes containers to root on host
2019-02-13 18:50:11
50m-ctf: CTF write-up: c8889970d9fb722066f31e804e351993
2019-03-03 10:08:22
50m-ctf: $50 million CTF Writeup
2019-03-25 02:28:13
zdt
zdt
runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)
2019-02-15 00:00:00
runC < 1.0-rc6 (Docker < 18.09.2) - Host Command Execution Exploit
2019-02-12 00:00:00
threatpost
threatpost
Public Clouds & Shared Responsibility: Lessons from Vulnerability Disclosure
2021-10-26 21:22:26
Major Container Security Flaw Threatens Cascading Attacks
2019-02-12 18:28:41
Rethinking Cyber-Defense Strategies in the Public-Cloud Age
2022-04-19 17:29:49
vmware
vmware
VMware product updates resolve mishandled file descriptor vulnerability in runc container runtime.
2019-02-15 00:00:00
VMware product updates resolve mishandled file descriptor vulnerability in runc container runtime.
2019-02-15 00:00:00
f5
f5
K46421255 : Docker privilege elevation vulnerability CVE-2019-5736
2019-03-01 00:00:00
exploitpack
exploitpack
runc 1.0-rc6 (Docker 18.09.2) - Container Breakout (2)
2019-02-13 00:00:00
virtuozzo
virtuozzo
Important kernel security update: Virtuozzo ReadyKernel patch 72.0 for all supported Virtuozzo kernels and that of Virtuozzo Infrastructure Platform 2.5
2019-02-12 00:00:00
thn
thn
RunC Flaw Lets Attackers Escape Linux Containers to Gain Root on Hosts
2019-02-12 08:59:00
Microsoft Warns of Cross-Account Takeover Bug in Azure Container Instances
2021-09-10 05:07:00
kitploit
kitploit
Whoc - A Container Image That Extracts The Underlying Container Runtime
2021-11-24 11:30:00
almalinux
almalinux
Important: container-tools:rhel8 security and bug fix update
2019-05-07 03:39:11
archlinux
archlinux
[ASA-201902-20] flatpak: privilege escalation
2019-02-17 00:00:00
[ASA-201902-6] runc: privilege escalation
2019-02-11 00:00:00
trendmicroblog
trendmicroblog
This Week in Security News: Instagram Hackers and Enterprise Threats
2019-03-01 14:57:50
Attacking Containers and runC
2019-02-12 19:22:35
qualysblog
qualysblog
RunC Container Breakout Vulnerability
2019-02-12 15:46:10

8.6 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

74.6%

JSON
Related for GLSA-202003-21
nessus53fedora13openvas37ubuntu1oraclelinux3debian2cve3alpinelinux2osv7redhatcve2prion3altlinux3veracode2redhat11suse8debiancve2amazon3mageia3photon4github2ubuntucve2cbl_mariner2ibm4impervablog1githubexploit4hackerone3zdt2threatpost3vmware2f51exploitpack1virtuozzo1thn2kitploit1almalinux1archlinux2trendmicroblog2qualysblog1