runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Runc | Linuxfoundation | * | 1.1.5 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | container-tools:4.0-8090020230828093056.e7857ab1 | * |
| Red Hat Enterprise Linux 8 | RedHat | container-tools:rhel8-8090020230825121312.e7857ab1 | * |
| Red Hat Enterprise Linux 9 | RedHat | runc-4:1.1.9-1.el9 | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-vsphere-csi-driver-syncer-rhel8:v4.13.0-202304190216.p0.g6f4295b.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | runc-4:1.1.6-4.rhaos4.13.el8 | * |
| Red Hat OpenShift Container Platform 4.14 | RedHat | openshift4/ose-vsphere-csi-driver-syncer-rhel8:v4.14.0-202310201027.p0.ga5ed57f.assembly.stream | * |
| Runc | Ubuntu | bionic | * |
| Runc | Ubuntu | devel | * |
| Runc | Ubuntu | esm-apps/xenial | * |
| Runc | Ubuntu | focal | * |
| Runc | Ubuntu | jammy | * |
| Runc | Ubuntu | kinetic | * |
| Runc | Ubuntu | lunar | * |
| Runc | Ubuntu | trusty | * |
| Runc | Ubuntu | xenial | * |