CVE-2019-19921

Technical details about CVE-2019-19921 are not publicly available in the provided Connected documents. The entries reference related advisories, but no concrete affected versions, root cause, or fixes are included here. Monitor for updates.

CVE-2023-27561

CVE-2023-27561 affects runc; a race condition in volume mounts between two containers with shared mounts can enable an escalation of privileges via libcontainer/rootfs_linux.go. The issue is a regression of CVE-2019-19921 and requires two containers with custom volume-mount configurations and cus...

CVE-2022-29162

CVE-2022-29162 affects runc prior to version 1.1.2, where runc exec --cap could create processes with inheritable Linux capabilities, enabling elevation of capabilities to the permitted set during execve. The issue does not affect the container sandbox since the inheritable set is bounded by the ...

CVE-2023-28642

Summary (concrete details): The CVE-2023-28642 issue affects the container runtime components, notably the runC tool. The root cause is an AppArmor bypass when a container’s /proc is symlinked under a specific mount configuration, enabling an attacker with local access to bypass confinement. The ...

CVE-2019-16884

Summary of CVE-2019-16884 (runc) : The vulnerability affects runc (as used in Docker and similar), where a flaw in libcontainer/rootfs_linux.go allows an AppArmor/SELinux restriction bypass by a malicious image that can mount over a container’s /proc directory. This arises from an incorrect check...

CVE-2025-31133

CVE-2025-31133 (runc) affects the runc runtime when using certain bind-mount sources, where verification of the source inode for "/dev/null" could be bypassed. Affected versions include 1.2.7 and earlier, 1.3.0-rc.1 through 1.3.1, and 1.4.0-rc.1 and 1.4.0-rc.2. The issue enables an attacker to pe...

CVE-2025-52881

CVE-2025-52881 affects runc (versions 1.2.7, 1.3.2, 1.4.0-rc.2). The issue lets an attacker redirect writes to /proc to other procfs files via a racing container with shared mounts (verified in Dockerfile-based parallel builds). This can enable container escape with high impact. Fixed in 1.2.8, 1...

CVE-2016-3697

CVE-2016-3697 affects Docker runtimes (libcontainer/user/user.go in runC) up to Docker 1.11.2, where a numeric UID is misinterpreted as a username in /etc/passwd inside a container, enabling local privilege escalation. The issue is tied to the runC/opencontainers code path (libcontainer) and allo...