runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)
Weakness
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Runc | Linuxfoundation | * | 0.1.1 (including) |
| Runc | Linuxfoundation | 1.0.0-rc1 (including) | 1.0.0-rc1 (including) |
| Runc | Linuxfoundation | 1.0.0-rc2 (including) | 1.0.0-rc2 (including) |
| Runc | Linuxfoundation | 1.0.0-rc3 (including) | 1.0.0-rc3 (including) |
| Runc | Linuxfoundation | 1.0.0-rc4 (including) | 1.0.0-rc4 (including) |
| Runc | Linuxfoundation | 1.0.0-rc5 (including) | 1.0.0-rc5 (including) |
| Runc | Linuxfoundation | 1.0.0-rc6 (including) | 1.0.0-rc6 (including) |
| Runc | Linuxfoundation | 1.0.0-rc7 (including) | 1.0.0-rc7 (including) |
| Runc | Linuxfoundation | 1.0.0-rc8 (including) | 1.0.0-rc8 (including) |
| Runc | Linuxfoundation | 1.0.0-rc9 (including) | 1.0.0-rc9 (including) |
| Red Hat Enterprise Linux 7 Extras | RedHat | runc-0:1.0.0-66.rc8.el7_7 | * |
| Red Hat Enterprise Linux 8 | RedHat | container-tools:rhel8-8020020200324071414.0d58ad57 | * |
| Red Hat OpenShift Container Platform 4.1 | RedHat | runc-0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0 | * |
| Red Hat OpenShift Container Platform 4.2 | RedHat | runc-0:1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8 | * |
| Red Hat OpenShift Container Platform 4.3 | RedHat | runc-0:1.0.0-66.rc10.rhaos4.3.el7_8 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-aws-machine-controllers:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-azure-machine-controllers:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-baremetal-machine-controllers:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-baremetal-rhel7-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cli:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cli-artifacts:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cloud-credential-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-authentication-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-autoscaler:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-autoscaler-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-bootstrap:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-config-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-dns-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-image-registry-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-ingress-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-kube-apiserver-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-kube-controller-manager-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-kube-scheduler-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-machine-approver:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-monitoring-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-network-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-node-tuning-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-openshift-apiserver-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-openshift-controller-manager-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-policy-controller-rhel7:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-samples-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-storage-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-update-keys:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-cluster-version-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-configmap-reloader:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-console:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-console-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-coredns:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-csi-snapshot-controller:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-csi-snapshot-controller-rhel7:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-deployer:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-docker-builder:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-docker-registry:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-etcd:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-grafana:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-haproxy-router:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-hyperkube:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-installer:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-installer-artifacts:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-ironic-hardware-inventory-recorder-rhel8:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-ironic-inspector-rhel8:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-ironic-ipa-downloader-rhel8:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-ironic-machine-os-downloader-rhel8:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-ironic-rhel8:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-ironic-static-ip-manager-rhel8:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-jenkins:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-jenkins-agent-maven:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-k8s-prometheus-adapter:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-keepalived-ipfailover:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-kube-proxy:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-kube-rbac-proxy:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-kube-state-metrics:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-kuryr-cni-rhel8:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-kuryr-controller-rhel8:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-libvirt-machine-controllers:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-local-storage-static-provisioner:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-machine-api-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-machine-config-operator:v4.4.0-202005011342 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-multus-admission-controller:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-multus-cni:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-must-gather:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-oauth-proxy:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-openstack-machine-controllers:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-operator-lifecycle-manager:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-operator-marketplace:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-operator-registry:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-ovn-kubernetes:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-pod:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-prometheus:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-prometheus-alertmanager:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-prometheus-config-reloader:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-prometheus-node-exporter:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-prometheus-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-prom-label-proxy:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-service-ca-operator:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-telemeter:v4.4.0-202004261927 | * |
| Red Hat OpenShift Container Platform 4.4 | RedHat | openshift4/ose-tests:v4.4.0-202004261927 | * |
| Runc | Ubuntu | bionic | * |
| Runc | Ubuntu | devel | * |
| Runc | Ubuntu | disco | * |
| Runc | Ubuntu | eoan | * |
| Runc | Ubuntu | esm-apps-legacy/xenial | * |
| Runc | Ubuntu | esm-apps/bionic | * |
| Runc | Ubuntu | esm-apps/xenial | * |
| Runc | Ubuntu | esm-infra/focal | * |
| Runc | Ubuntu | focal | * |
| Runc | Ubuntu | groovy | * |
| Runc | Ubuntu | hirsute | * |
| Runc | Ubuntu | impish | * |
| Runc | Ubuntu | jammy | * |
| Runc | Ubuntu | kinetic | * |
| Runc | Ubuntu | lunar | * |
| Runc | Ubuntu | upstream | * |
| Runc | Ubuntu | xenial | * |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/159.html
- https://cwe.mitre.org/data/definitions/177.html
- https://cwe.mitre.org/data/definitions/48.html
- https://cwe.mitre.org/data/definitions/641.html
References
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html
- https://access.redhat.com/errata/RHSA-2020:0688
- https://access.redhat.com/errata/RHSA-2020:0695
- https://github.com/opencontainers/runc/issues/2197
- https://github.com/opencontainers/runc/pull/2190
- https://github.com/opencontainers/runc/releases
- https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/
- https://security-tracker.debian.org/tracker/CVE-2019-19921
- https://security.gentoo.org/glsa/202003-21
- https://usn.ubuntu.com/4297-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html
- https://access.redhat.com/errata/RHSA-2020:0688
- https://access.redhat.com/errata/RHSA-2020:0695
- https://github.com/opencontainers/runc/issues/2197
- https://github.com/opencontainers/runc/pull/2190
- https://github.com/opencontainers/runc/releases
- https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/
- https://security-tracker.debian.org/tracker/CVE-2019-19921
- https://security.gentoo.org/glsa/202003-21
- https://usn.ubuntu.com/4297-1/