Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in RunC

🗓️ 07 Dec 2021 21:22:39Reported by GitHub Advisory DatabaseType

Overflow in netlink bytemsg length field leads to RunC container configuration override by attacke

Reporter	Title	Published	Views	Family All 99
ALT Linux	Security fix for the ALT Linux 10 package runc version 1.0.3-alt1	17 Dec 202100:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202316:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	25 Sep 202516:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	18 May 202613:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data	29 Jun 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	26 Mar 202503:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	15 Apr 202503:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to several issues due to the go compiler	8 Aug 202414:17	–	ibm
AlpineLinux	CVE-2021-43784	6 Dec 202100:00	–	alpinelinux
AlmaLinux	Moderate: runc security update	7 Nov 202300:00	–	almalinux

Vulners

Node

Source	Link
github	www.github.com/opencontainers/runc/security/advisories/GHSA-v95c-p5hm-xq8f
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-43784
github	www.github.com/opencontainers/runc/commit/9c444070ec7bb83995dbc0185da68284da71c554
github	www.github.com/opencontainers/runc/commit/d72d057ba794164c3cce9451a00b72a78b25e1ae
github	www.github.com/opencontainers/runc/commit/f50369af4b571e358f20b139eea52d612eb55eed
bugs	www.bugs.chromium.org/p/project-zero/issues/detail
lists	www.lists.debian.org/debian-lts-announce/2021/12/msg00005.html
github	www.github.com/opencontainers/runc/commit/dde509df4e28cec33b3c99c6cda3d4fd5beafc77
pkg	www.pkg.go.dev/vuln/GO-2022-0274
lists	www.lists.debian.org/debian-lts-announce/2024/02/msg00005.html

27 Feb 2024 05:06Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15 - 6

CVSS 26

EPSS0.00126

SSVC