Description RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.
CVSS vector CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Exploitability: 0.5 | Impact: 5.9 Attack Vector: Local
Complexity: High
Privileges: High
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High
Affected Packages8 packages Show 3 more packages
🔴 Vulnerability Details7 GHSA runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects ↗ 2025-11-05 ▶ OSV runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects ↗ 2025-11-05 ▶ OSV Information Exposure in RunC in github.com/opencontainers/runc ↗ 2024-08-21 ▶ GHSA GHSA-26mh-fmrh-48w9: The docker packages version docker-1 ↗ 2022-05-24 ▶ OSV Information Exposure in RunC ↗ 2021-12-20 ▶ Show 2 more
📋 Vendor Advisories4 Red Hat docker: Security regression of CVE-2016-9962 due to inclusion of vulnerable runc ↗ 2020-06-23 ▶ Debian CVE-2020-14300: docker.io - The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red... ↗ 2020 ▶ Red Hat docker: insecure opening of file-descriptor allows privilege escalation ↗ 2017-01-11 ▶ Debian CVE-2016-9962: docker.io - RunC allowed additional container processes via 'runc exec' to be ptraced by the... ↗ 2016 ▶
🕵️ Threat Intelligence6 Unit42 Non-Root Containers, Kubernetes CVE-2019-11245 and Why You Should Care ↗ 2019-08-28 ▶ Unit42 Non-Root Containers, Kubernetes CVE-2019-11245 and Why You Should Care ↗ 2019-08-28 ▶ Unit42 Making Containers More Isolated: An Overview of Sandboxed Container Technologies ↗ 2019-06-06 ▶ Unit42 Making Containers More Isolated: An Overview of Sandboxed Container Technologies ↗ 2019-06-06 ▶ Unit42 Breaking out of Docker via runC – Explaining CVE-2019-5736 ↗ 2019-02-21 ▶ Show 1 more
📄 Research Papers1 arXiv Threat Modeling and Security Analysis of Containers: A Survey ↗ 2021-11-22 ▶
💬 Community3 Bugzilla CVE-2020-14300 docker: Security regression of CVE-2016-9962 due to inclusion of vulnerable runc ↗ 2020-06-19 ▶ Bugzilla CVE-2016-9962 runc: docker: insecure opening of file-descriptor allows privilege escalation [fedora-all] ↗ 2017-01-11 ▶ Bugzilla CVE-2016-9962 docker: insecure opening of file-descriptor allows privilege escalation ↗ 2017-01-02 ▶