CVE-2019-19921
Fixed in a distro release EPSS <1%
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)
Products: linuxfoundation runc, debian_linux, opensuse leap, canonical ubuntu_linux, redhat openshift_container_platform
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/opencontainers/runc | 1.0.0-rc9.0.20200122160610-2fc03cc11c77 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | aardvark-dns | 2:1.0.1-38.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | aardvark-dns | 2:1.7.0-1.module_el8.9.0+3657+d86e192f |
| AlmaLinux 8 | buildah | 1:1.24.6-7.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | buildah | 1:1.31.3-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | buildah-tests | 1:1.24.6-7.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | buildah-tests | 1:1.31.3-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | cockpit-podman | 75-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | cockpit-podman | 46-1.module_el8.7.0+3344+5bcd850f |
| AlmaLinux 8 | conmon | 2:2.1.4-2.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | conmon | 3:2.1.8-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | container-selinux | 2:2.221.0-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | container-selinux | 2:2.205.0-3.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | containernetworking-plugins | 1:1.3.0-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | containernetworking-plugins | 1:1.1.1-5.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | containers-common | 2:1-54.module_el8.9.0+3673+0c64b403 |
| AlmaLinux 8 | containers-common | 2:1-38.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | crit | 3.15-3.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux 8 | crit | 3.18-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | crit | 3.12-9.module_el8.3.0+2044+12421f43 |
| AlmaLinux 8 | crit | 3.12-9.module_el8.4.0+2496+12421f43 |
| AlmaLinux 8 | crit | 3.12-9.module_el8.5.0+119+9a9ec082 |
| AlmaLinux 8 | crit | 3.15-3.module_el8.6.0+3137+d33c3efb |
| AlmaLinux 8 | criu | 3.18-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | criu | 3.12-9.module_el8.5.0+119+9a9ec082 |
| AlmaLinux 8 | criu | 3.15-3.module_el8.6.0+3137+d33c3efb |
| AlmaLinux 8 | criu | 3.12-9.module_el8.3.0+2044+12421f43 |
| AlmaLinux 8 | criu | 3.15-3.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux 8 | criu | 3.12-9.module_el8.4.0+2496+12421f43 |
| AlmaLinux 8 | criu-devel | 3.15-3.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux 8 | criu-devel | 3.15-3.module_el8.6.0+3137+d33c3efb |
| AlmaLinux 8 | criu-devel | 3.18-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | criu-libs | 3.15-3.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux 8 | criu-libs | 3.15-3.module_el8.6.0+3137+d33c3efb |
| AlmaLinux 8 | criu-libs | 3.18-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | crun | 1.8.7-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | crun | 1.8.3-1.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | fuse-overlayfs | 1.12-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | fuse-overlayfs | 1.9-2.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | libslirp | 4.4.0-1.module_el8.6.0+3137+d33c3efb |
| AlmaLinux 8 | libslirp | 4.4.0-1.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux 8 | libslirp | 4.4.0-1.module_el8.8.0+3615+3543c705 |
| AlmaLinux 8 | libslirp-devel | 4.4.0-1.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux 8 | libslirp-devel | 4.4.0-1.module_el8.6.0+3137+d33c3efb |
| AlmaLinux 8 | libslirp-devel | 4.4.0-1.module_el8.8.0+3615+3543c705 |
| AlmaLinux 8 | netavark | 2:1.0.1-38.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | netavark | 2:1.7.0-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | oci-seccomp-bpf-hook | 1.2.9-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module_el8.8.0+3468+16b86c82 |
| AlmaLinux 8 | podman | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | podman | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | podman-catatonit | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | podman-catatonit | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | podman-docker | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | podman-docker | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | podman-gvproxy | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | podman-gvproxy | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | podman-plugins | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | podman-plugins | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | podman-remote | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | podman-remote | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | podman-tests | 2:4.0.2-24.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | podman-tests | 3:4.6.1-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39 |
| AlmaLinux 8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455 |
| AlmaLinux 8 | python3-criu | 3.18-4.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | python3-criu | 3.12-9.module_el8.5.0+119+9a9ec082 |
| AlmaLinux 8 | python3-criu | 3.15-3.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux 8 | python3-criu | 3.15-3.module_el8.6.0+3137+d33c3efb |
| AlmaLinux 8 | python3-criu | 3.12-9.module_el8.3.0+2044+12421f43 |
| AlmaLinux 8 | python3-criu | 3.12-9.module_el8.4.0+2496+12421f43 |
| AlmaLinux 8 | python3-podman | 4.0.0-2.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | python3-podman | 4.6.0-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | runc | 1:1.1.5-2.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | runc | 1:1.1.9-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | skopeo | 2:1.13.3-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | skopeo | 2:1.6.2-8.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | skopeo-tests | 2:1.13.3-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | skopeo-tests | 2:1.6.2-8.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | slirp4netns | 1.2.1-1.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | slirp4netns | 1.1.8-3.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | slirp4netns | 0.4.2-3.git21fdece.module_el8.5.0+2635+e4386a39 |
| AlmaLinux 8 | slirp4netns | 0.4.2-3.git21fdece.module_el8.5.0+108+00865455 |
| AlmaLinux 8 | toolbox | 0.0.7-1.module_el8.5.0+108+00865455 |
| AlmaLinux 8 | toolbox | 0.0.99.4-5.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | toolbox | 0.0.7-1.module_el8.5.0+2635+e4386a39 |
| AlmaLinux 8 | toolbox | 0.0.99.4-5.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | toolbox-tests | 0.0.99.4-5.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | toolbox-tests | 0.0.99.4-5.module_el8.9.0+3643+9234dc3b |
| AlmaLinux 8 | udica | 0.2.6-4.module_el8.9.0+3627+db8ec155 |
| AlmaLinux 8 | udica | 0.2.1-2.module_el8.5.0+108+00865455 |
| AlmaLinux 8 | udica | 0.2.1-2.module_el8.5.0+2635+e4386a39 |
| AlmaLinux 8 | udica | 0.2.6-20.module_el8.8.0+3615+3543c705 |
| AlmaLinux 9 | runc | 4:1.1.9-1.el9 |
| Chainguard | runc | 0 |
| Chainguard | runc-doc | 0 |
| Debian 10 | runc | 1.0.0~rc6+dfsg1-3+deb10u2 |
| Debian 12 | runc | 1.0.0~rc10+dfsg1-1 |
| Debian 13 | runc | 1.0.0~rc10+dfsg1-1 |
| Debian 14 | runc | 1.0.0~rc10+dfsg1-1 |
| Red Hat Enterprise Linux 8 | buildah | 0:1.11.6-7.module+el8.2.0+5856+b8046c6d |
| Red Hat Enterprise Linux 8 | buildah-debuginfo | 0:1.11.6-7.module+el8.2.0+5856+b8046c6d |
| Red Hat Enterprise Linux 8 | buildah-debugsource | 0:1.11.6-7.module+el8.2.0+5856+b8046c6d |
| Red Hat Enterprise Linux 8 | buildah-tests | 0:1.11.6-7.module+el8.2.0+5856+b8046c6d |
| Red Hat Enterprise Linux 8 | buildah-tests-debuginfo | 0:1.11.6-7.module+el8.2.0+5856+b8046c6d |
| Red Hat Enterprise Linux 8 | cockpit-podman | 0:12-1.module+el8.2.0+5950+6d183a6a |
| Red Hat Enterprise Linux 8 | conmon | 2:2.0.6-1.module+el8.2.0+5182+3136e5d4 |
| Red Hat Enterprise Linux 8 | container-selinux | 2:2.124.0-1.module+el8.2.0+5182+3136e5d4 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins | 0:0.8.3-5.module+el8.2.0+5201+6b31f0d9 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins-debuginfo | 0:0.8.3-5.module+el8.2.0+5201+6b31f0d9 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins-debugsource | 0:0.8.3-5.module+el8.2.0+5201+6b31f0d9 |
| Red Hat Enterprise Linux 8 | containers-common | 1:0.1.40-10.module+el8.2.0+5955+6cd70ceb |
| Red Hat Enterprise Linux 8 | crit | 0:3.12-9.module+el8.2.0+5029+3ac48e7d |
| Red Hat Enterprise Linux 8 | criu | 0:3.12-9.module+el8.2.0+5029+3ac48e7d |
| Red Hat Enterprise Linux 8 | criu-debuginfo | 0:3.12-9.module+el8.2.0+5029+3ac48e7d |
| Red Hat Enterprise Linux 8 | criu-debugsource | 0:3.12-9.module+el8.2.0+5029+3ac48e7d |
| Red Hat Enterprise Linux 8 | fuse-overlayfs | 0:0.7.2-5.module+el8.2.0+6060+9dbc027d |
| Red Hat Enterprise Linux 8 | fuse-overlayfs-debuginfo | 0:0.7.2-5.module+el8.2.0+6060+9dbc027d |
| Red Hat Enterprise Linux 8 | fuse-overlayfs-debugsource | 0:0.7.2-5.module+el8.2.0+6060+9dbc027d |
| Red Hat Enterprise Linux 8 | podman | 0:1.6.4-10.module+el8.2.0+6063+e761893a |
| Red Hat Enterprise Linux 8 | podman-debuginfo | 0:1.6.4-10.module+el8.2.0+6063+e761893a |
| Red Hat Enterprise Linux 8 | podman-debugsource | 0:1.6.4-10.module+el8.2.0+6063+e761893a |
| Red Hat Enterprise Linux 8 | podman-docker | 0:1.6.4-10.module+el8.2.0+6063+e761893a |
| Red Hat Enterprise Linux 8 | podman-remote | 0:1.6.4-10.module+el8.2.0+6063+e761893a |
| Red Hat Enterprise Linux 8 | podman-remote-debuginfo | 0:1.6.4-10.module+el8.2.0+6063+e761893a |
| Red Hat Enterprise Linux 8 | podman-tests | 0:1.6.4-10.module+el8.2.0+6063+e761893a |
| Red Hat Enterprise Linux 8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.2.0+5201+6b31f0d9 |
| Red Hat Enterprise Linux 8 | python3-criu | 0:3.12-9.module+el8.2.0+5029+3ac48e7d |
| Red Hat Enterprise Linux 8 | runc | 0:1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb |
| Red Hat Enterprise Linux 8 | runc-debuginfo | 0:1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb |
| Red Hat Enterprise Linux 8 | runc-debugsource | 0:1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb |
| Red Hat Enterprise Linux 8 | skopeo | 1:0.1.40-10.module+el8.2.0+5955+6cd70ceb |
| Red Hat Enterprise Linux 8 | skopeo-debuginfo | 1:0.1.40-10.module+el8.2.0+5955+6cd70ceb |
| Red Hat Enterprise Linux 8 | skopeo-debugsource | 1:0.1.40-10.module+el8.2.0+5955+6cd70ceb |
| Red Hat Enterprise Linux 8 | skopeo-tests | 1:0.1.40-10.module+el8.2.0+5955+6cd70ceb |
| Red Hat Enterprise Linux 8 | slirp4netns | 0:0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d |
| Red Hat Enterprise Linux 8 | slirp4netns-debuginfo | 0:0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d |
| Red Hat Enterprise Linux 8 | slirp4netns-debugsource | 0:0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d |
| Red Hat Enterprise Linux 8 | toolbox | 0:0.0.7-1.module+el8.2.0+6096+9c3f08f3 |
| Red Hat Enterprise Linux 8 | udica | 0:0.2.1-2.module+el8.2.0+4896+8f613c81 |
| Red Hat openshift 4.1 | runc | 0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0 |
| Red Hat openshift 4.1 | runc-debuginfo | 0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0 |
| Red Hat openshift 4.1 | runc-debugsource | 0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0 |
| Red Hat openshift 4.2 | runc | 0:1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8 |
| Red Hat openshift 4.2 | runc-debuginfo | 0:1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8 |
| Red Hat openshift 4.2 | runc-debugsource | 0:1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8 |
| Red Hat openshift 4.3 | runc | 0:1.0.0-66.rc10.rhaos4.3.el7_8 |
| Red Hat openshift 4.3 | runc-debuginfo | 0:1.0.0-66.rc10.rhaos4.3.el7_8 |
| Red Hat rhel extras other 7 | runc | 0:1.0.0-66.rc8.el7_7 |
| Red Hat rhel extras other 7 | runc-debuginfo | 0:1.0.0-66.rc8.el7_7 |
| Rocky Linux 8 | container-selinux | 2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f |
| Rocky Linux 8 | criu | 0:3.12-9.module+el8.5.0+681+c9a1951f |
| Rocky Linux 8 | criu | 0:3.12-9.module+el8.4.0+557+48ba8b2f |
| Rocky Linux 8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861 |
| Rocky Linux 8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d |
| Rocky Linux 8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2 |
| Rocky Linux 8 | runc | 0:1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2 |
| Rocky Linux 8 | slirp4netns | 0:0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861 |
| Rocky Linux 8 | slirp4netns | 0:0.4.2-3.git21fdece.module+el8.4.0+536+994a2182 |
| Rocky Linux 8 | slirp4netns | 0:0.4.2-3.git21fdece.module+el8.5.0+708+6758137d |
| Rocky Linux 8 | toolbox | 0:0.0.7-1.module+el8.5.0+770+e2f49861 |
| Rocky Linux 8 | toolbox | 0:0.0.7-1.module+el8.5.0+708+6758137d |
| Rocky Linux 8 | toolbox | 0:0.0.7-1.module+el8.4.0+559+c02fa3b2 |
| Rocky Linux 8 | udica | 0:0.2.1-2.module+el8.4.0+559+c02fa3b2 |
| Rocky Linux 8 | udica | 0:0.2.1-2.module+el8.5.0+770+e2f49861 |
| Rocky Linux 8 | udica | 0:0.2.1-2.module+el8.5.0+708+6758137d |
| SUSE Linux Enterprise Module for Containers 12 | containerd | 1.4.4-16.38.1 |
| SUSE Linux Enterprise Module for Containers 12 | docker | 20.10.6_ce-98.66.1 |
| SUSE Linux Enterprise Module for Containers 12 | docker-runc | 1.0.0rc8+gitr3917_3e425f80a8c9-1.40.1 |
| SUSE Linux Enterprise Module for Containers 12 | runc | 1.0.0~rc93-16.8.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | docker-runc | 1.0.0rc8+gitr3917_3e425f80a8c9-6.32.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | runc | 1.0.0~rc10-1.9.1 |
| Ubuntu 18.04 LTS | runc | 1.0.0~rc10-0ubuntu1~18.04.2 |
| Ubuntu 20.04 LTS | runc | 1.0.0~rc10-0ubuntu1 |
| Ubuntu Pro 16.04 LTS | runc | 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4 |
| Wolfi | runc | 0 |
| Wolfi | runc-doc | 0 |
| openSUSE Leap 15.1 | docker-runc | 1.0.0rc8+gitr3917_3e425f80a8c9-lp151.3.15.1 |
| openSUSE Tumbleweed | runc | 1.0.2-1.2 |