CVE-2019-19921
EUVD-2021-106012.02.2020, 15:15
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| linuxfoundation | runc | 𝑥 ≤ 0.1.1 |
| linuxfoundation | runc | 1.0.0:rc1 |
| linuxfoundation | runc | 1.0.0:rc2 |
| linuxfoundation | runc | 1.0.0:rc3 |
| linuxfoundation | runc | 1.0.0:rc4 |
| linuxfoundation | runc | 1.0.0:rc5 |
| linuxfoundation | runc | 1.0.0:rc6 |
| linuxfoundation | runc | 1.0.0:rc7 |
| linuxfoundation | runc | 1.0.0:rc8 |
| linuxfoundation | runc | 1.0.0:rc9 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| opensuse | leap | 15.1 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.10 |
| redhat | openshift_container_platform | 4.1 |
| redhat | openshift_container_platform | 4.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| runc |
|
Common Weakness Enumeration
References