CVE-2019-19921
CVE-2019-19921
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)
CVSS 7.0 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system · containers
Produits et versions concernés
n/a
- Versions du logiciel
- n/a: Concernée
Aucun correctif publié
runc Debian:12
- Plages de versions concernées
- ECOSYSTEM: < 1.0.0~rc10+dfsg1-1
Mettez à jour vers 1.0.0~rc10+dfsg1-1
runc Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 1.0.0~rc10+dfsg1-1
Mettez à jour vers 1.0.0~rc10+dfsg1-1
runc Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 1.0.0~rc10+dfsg1-1
Mettez à jour vers 1.0.0~rc10+dfsg1-1
runc Ubuntu:Pro:16.04:LTS
- Versions du logiciel
- 0.0.8+dfsg-2
- 0.1.1-0ubuntu5~16.04
- 1.0.0~rc1-0ubuntu1~16.04
- 1.0.0~rc1-0ubuntu2~16.04.1
- 1.0.0~rc1-0ubuntu2~16.04.1.1
- 1.0.0~rc2-0ubuntu2~16.04.1
- 1.0.0~rc2+docker1.12.6-0ubuntu1~16.04.1
- 1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.1
- 1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.2
- 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.3
- 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4
- 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm1
- 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2
- Plages de versions concernées
- ECOSYSTEM: < 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4
Mettez à jour vers 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4
runc Ubuntu:18.04:LTS
- Versions du logiciel
- 1.0.0~rc2+docker1.13.1-0ubuntu1
- 1.0.0~rc4+dfsg1-2
- 1.0.0~rc4+dfsg1-6
- 1.0.0~rc4+dfsg1-6ubuntu0.18.04.1
- 1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.1
- 1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.2
- 1.0.0~rc10-0ubuntu1~18.04.1
- Plages de versions concernées
- ECOSYSTEM: < 1.0.0~rc10-0ubuntu1~18.04.2
Mettez à jour vers 1.0.0~rc10-0ubuntu1~18.04.2
runc Ubuntu:20.04:LTS
- Versions du logiciel
- 1.0.0~rc8+git20190923.3e425f80-0ubuntu1
- Plages de versions concernées
- ECOSYSTEM: < 1.0.0~rc10-0ubuntu1
Mettez à jour vers 1.0.0~rc10-0ubuntu1
Sources originales
- https://github.com/opencontainers/runc/releases
- https://security-tracker.debian.org/tracker/CVE-2019-19921
- https://github.com/opencontainers/runc/issues/2197
- https://github.com/opencontainers/runc/pull/2190
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html
- https://access.redhat.com/errata/RHSA-2020:0688
- https://access.redhat.com/errata/RHSA-2020:0695
- https://security.gentoo.org/glsa/202003-21
- https://usn.ubuntu.com/4297-1/
- https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/
- https://nvd.nist.gov/vuln/detail/CVE-2019-19921