8.6 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
8.5 High
AI Score
Confidence
High
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.051 Low
EPSS
Percentile
92.9%
runc is a CLI tool for spawning and running containers on Linux according
to the OCI specification. In runc 1.1.11 and earlier, due to an internal
file descriptor leak, an attacker could cause a newly-spawned container
process (from runc exec) to have a working directory in the host filesystem
namespace, allowing for a container escape by giving access to the host
filesystem (“attack 2”). The same attack could be used by a malicious image
to allow a container process to gain access to the host filesystem through
runc run (“attack 1”). Variants of attacks 1 and 2 could be also be used to
overwrite semi-arbitrary host binaries, allowing for complete container
escapes (“attack 3a” and “attack 3b”). runc 1.1.12 includes patches for
this issue.
Author | Note |
---|---|
Priority reason: Allows an attacker to escape containers | |
0xnishit | affected versions >=v1.0.0-rc93,<=1.1.11 |
8.6 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
8.5 High
AI Score
Confidence
High
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.051 Low
EPSS
Percentile
92.9%