runc through 1.0-rc6 as used in Docker before 18.09.2 and other products allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image or (2) an existing container to which the attacker previously had write access that can be attached with docker exec. This occurs because of file-descriptor mishandling related to /proc/self/exe.

🗓️ 16 Jul 2021 00:00:00Reported by MicrosoftType

Runc 1.0-rc6 in Docker before 18.09.2 allows host runc overwrite and root access through attacker controlled or attachable containers due to /proc/self/executable.

Reporter	Title	Published	Views	Family All 333
0day.today	runC < 1.0-rc6 (Docker < 18.09.2) - Host Command Execution Exploit	12 Feb 201900:00	–	zdt
0day.today	runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)	15 Feb 201900:00	–	zdt
0day.today	Docker Container Escape Exploit	1 Jul 202100:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Cloud Private for Data is affected by an issue with runc used by Docker	3 Oct 201922:50	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Docker affects PowerKVM	17 May 201916:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Private is affected by an issue with runc used by Docker	3 Nov 202122:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local	20 Dec 201913:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Functions is affected by a privilege escalation vulnerability in runc	18 Feb 201920:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is affected by a critical vulnerability in Kubernetes via runc (CVE-2019-5736)	5 Mar 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a privilege escalation vulnerability in runc	18 Feb 201919:10	–	ibm

Vulners

Node

microsoft cm1_moby-buildx_0.4.1+azure-3Range<-

16 Jul 2021 00:00Current

7High risk

Vulners AI Score7

CVSS 3.18.6

CVSS 29.3

EPSS0.59178