CVE-2019-19921

Published: Feb 12, 2020Modified: Jun 17, 2026

7.0

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.0 / Impact: 5.9

Source: NVD

Description

runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)

Affected (17)

Products: Linuxfoundation: Runc · Debian: Debian Linux · Opensuse: Leap · +2 more

Show all products

Linuxfoundation: Runc · Debian: Debian Linux · Opensuse: Leap · Canonical: Ubuntu Linux · Redhat: Openshift Container Platform

Linuxfoundation

1 product

1 product

1 product

1 product

1 product

Openshift Container Platform

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Runc	version ≤ 0.1.1
Linuxfoundation Runc	Version 1.0.0 rc1
Linuxfoundation Runc	Version 1.0.0 rc2
Linuxfoundation Runc	Version 1.0.0 rc3
Linuxfoundation Runc	Version 1.0.0 rc4
Linuxfoundation Runc	Version 1.0.0 rc5
Linuxfoundation Runc	Version 1.0.0 rc6
Linuxfoundation Runc	Version 1.0.0 rc7
Linuxfoundation Runc	Version 1.0.0 rc8
Linuxfoundation Runc	Version 1.0.0 rc9

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0
Opensuse Leap	Version 15.1

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.10

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 4.1
Redhat Openshift Container Platform	Version 4.2

Related CWEs

Use of Incorrectly-Resolved Name or Reference

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

References (30)

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html

Source: cve@mitre.org

Broken LinkMailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2020:0688

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0695

Source: cve@mitre.org

Third Party Advisory

https://github.com/opencontainers/runc/issues/2197

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/opencontainers/runc/pull/2190

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://github.com/opencontainers/runc/releases

Source: cve@mitre.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/

Source: cve@mitre.org

https://security-tracker.debian.org/tracker/CVE-2019-19921

Source: cve@mitre.org

Third Party Advisory

https://security.gentoo.org/glsa/202003-21

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4297-1/

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkMailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2020:0688

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0695

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/opencontainers/runc/issues/2197

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://github.com/opencontainers/runc/pull/2190

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://github.com/opencontainers/runc/releases

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security-tracker.debian.org/tracker/CVE-2019-19921

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.gentoo.org/glsa/202003-21

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4297-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.