CVE-2023-27561
published 2023-03-03CVE-2023-27561: runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must…
PriorityP433high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.44%
35.9th percentile
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | runc | < runc 1.1.5+ds1-1 (bookworm) | runc 1.1.5+ds1-1 (bookworm) |
| github.com | opencontainers_runc | >= 0 < 1.1.5 | 1.1.5 |
| github.com | opencontainers_runc | >= 1.0.0-rc95 < 1.1.5 | 1.1.5 |
| linuxfoundation | runc | < 1.1.5 | 1.1.5 |
| linuxfoundation | runc | >= 0 < 1.0.0~rc93+ds1-5+deb11u5 | 1.0.0~rc93+ds1-5+deb11u5 |
| linuxfoundation | runc | >= 0 < 1.1.5+ds1-1 | 1.1.5+ds1-1 |
| linuxfoundation | runc | >= 0 < 1.1.5+ds1-1 | 1.1.5+ds1-1 |
| linuxfoundation | runc | >= 0 < 1.1.5+ds1-1 | 1.1.5+ds1-1 |
| linuxfoundation | runc | >= 0 < 1.1.4-0ubuntu1~18.04.2 | 1.1.4-0ubuntu1~18.04.2 |
| linuxfoundation | runc | >= 0 < 1.1.4-0ubuntu1~20.04.3 | 1.1.4-0ubuntu1~20.04.3 |
| linuxfoundation | runc | >= 0 < 1.1.4-0ubuntu1~22.04.3 | 1.1.4-0ubuntu1~22.04.3 |
| linuxfoundation | runc | >= 0 < 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4 | 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4 |
| msrc | cbl2_moby-runc_1.1.5-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_moby-runc_1.1.5+azure-1_on_cbl_mariner_1.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa7.0HIGH
osv7.0HIGH
vendor_debian7.0HIGH
vendor_msrc7.0HIGH
vendor_redhat7.0HIGH
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc
osv·2024-08-20
CVE-2023-27561 Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc
Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc
Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc
OSV
runc vulnerabilities
osv·2023-05-23·CVSS 7.0
CVE-2019-19921 [HIGH] runc vulnerabilities
runc vulnerabilities
USN-6088-1 fixed vulnerabilities in runC. This update provides
the corresponding updates for Ubuntu 16.04 LTS.
It was discovered that runC incorrectly performed access control when
mounting /proc to non-directories. An attacker could possibly use
this issue to escalate privileges.
(CVE-2019-19921)
Felix Wilhelm discovered that runC incorrecly handled netlink
messages. An attacker could possibly use
this issue to escalate privileges. (CVE-2021-43784)
Andrew G. Morgan discovered that runC incorrectly set
inherited process capabilities inside the container.
An attacker could possibly use this issue to
escalate privileges. (CVE-2022-29162)
Original advisory details:
It was discovered that runC incorrectly made /sys/fs/cgroup
writable when in rootless mode. An attacke
OSV
runc vulnerabilities
osv·2023-05-18·CVSS 6.3
CVE-2023-25809 [MEDIUM] runc vulnerabilities
runc vulnerabilities
It was discovered that runC incorrectly made /sys/fs/cgroup
writable when in rootless mode. An attacker could possibly
use this issue to escalate privileges. (CVE-2023-25809)
It was discovered that runC incorrectly performed access control when
mounting /proc to non-directories. An attacker could possibly use
this issue to escalate privileges. (CVE-2023-27561)
It was discovered that runC incorrectly handled /proc and
/sys mounts inside a container. An attacker could possibly
use this issue to bypass AppArmor, and potentially SELinux.
(CVE-2023-28642)
GHSA
runc AppArmor bypass with symlinked /proc
ghsa·2023-03-30·CVSS 7.0
CVE-2023-28642 [HIGH] CWE-281 runc AppArmor bypass with symlinked /proc
runc AppArmor bypass with symlinked /proc
### Impact
It was found that AppArmor, and potentially SELinux, can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration.
### Patches
Fixed in runc v1.1.5, by prohibiting symlinked `/proc`: https://github.com/opencontainers/runc/pull/3785
This PR fixes CVE-2023-27561 as well.
### Workarounds
Avoid using an untrusted container image.
OSV
runc AppArmor bypass with symlinked /proc
osv·2023-03-30·CVSS 7.0
CVE-2023-28642 [HIGH] runc AppArmor bypass with symlinked /proc
runc AppArmor bypass with symlinked /proc
### Impact
It was found that AppArmor, and potentially SELinux, can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration.
### Patches
Fixed in runc v1.1.5, by prohibiting symlinked `/proc`: https://github.com/opencontainers/runc/pull/3785
This PR fixes CVE-2023-27561 as well.
### Workarounds
Avoid using an untrusted container image.
OSV
CVE-2023-27561: runc through 1
osv·2023-03-03·CVSS 7.0
CVE-2023-27561 [HIGH] CVE-2023-27561: runc through 1
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
OSV
Opencontainers runc Incorrect Authorization vulnerability
osv·2023-03-03·CVSS 7.0
CVE-2023-27561 [HIGH] Opencontainers runc Incorrect Authorization vulnerability
Opencontainers runc Incorrect Authorization vulnerability
runc 1.0.0-rc95 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to `libcontainer/rootfs_linux.go`. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
GHSA
Opencontainers runc Incorrect Authorization vulnerability
ghsa·2023-03-03·CVSS 7.0
CVE-2023-27561 [HIGH] CWE-706 Opencontainers runc Incorrect Authorization vulnerability
Opencontainers runc Incorrect Authorization vulnerability
runc 1.0.0-rc95 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to `libcontainer/rootfs_linux.go`. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
Ubuntu
runC vulnerabilities
vendor_ubuntu·2023-05-23·CVSS 7.0
CVE-2022-29162 [HIGH] runC vulnerabilities
Title: runC vulnerabilities
Summary: Several security issues were fixed in runC.
USN-6088-1 fixed vulnerabilities in runC. This update provides
the corresponding updates for Ubuntu 16.04 LTS.
It was discovered that runC incorrectly performed access control when
mounting /proc to non-directories. An attacker could possibly use
this issue to escalate privileges.
(CVE-2019-19921)
Felix Wilhelm discovered that runC incorrecly handled netlink
messages. An attacker could possibly use
this issue to escalate privileges. (CVE-2021-43784)
Andrew G. Morgan discovered that runC incorrectly set
inherited process capabilities inside the container.
An attacker could possibly use this issue to
escalate privileges. (CVE-2022-29162)
Original advisory details:
It was discovered that runC incorrectly m
Ubuntu
runC vulnerabilities
vendor_ubuntu·2023-05-18·CVSS 5.0
CVE-2023-28642 [MEDIUM] runC vulnerabilities
Title: runC vulnerabilities
Summary: Several security issues were fixed in runC.
It was discovered that runC incorrectly made /sys/fs/cgroup
writable when in rootless mode. An attacker could possibly
use this issue to escalate privileges. (CVE-2023-25809)
It was discovered that runC incorrectly performed access control when
mounting /proc to non-directories. An attacker could possibly use
this issue to escalate privileges. (CVE-2023-27561)
It was discovered that runC incorrectly handled /proc and
/sys mounts inside a container. An attacker could possibly
use this issue to bypass AppArmor, and potentially SELinux.
(CVE-2023-28642)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges related to libcontainer/rootfs_linux.go. To exploit this an attacker must be able to spawn two containers with custo
vendor_msrc·2023-03-14·CVSS 7.0
CVE-2023-27561 [HIGH] CWE-706 runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges related to libcontainer/rootfs_linux.go. To exploit this an attacker must be able to spawn two containers with custo
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges related to libcontainer/rootfs_linux.go. To exploit this an attacker must be able to spawn two containers with custom volume-mount configurations and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/V
Red Hat
runc: volume mount race condition (regression of CVE-2019-19921)
vendor_redhat·2023-02-20·CVSS 7.0
CVE-2023-27561 [HIGH] CWE-41 runc: volume mount race condition (regression of CVE-2019-19921)
runc: volume mount race condition (regression of CVE-2019-19921)
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
A flaw was found in runc. An attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization by adding a symlink to the rootfs that points to a directory on the volume.
Statement: The vulnerability in runc, related to Incorrect Access Control in libcontainer/rootfs_linux.go, is classified as a moderate severity issue due to its
Debian
CVE-2023-27561: runc - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privile...
vendor_debian·2023·CVSS 7.0
CVE-2023-27561 [HIGH] CVE-2023-27561: runc - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privile...
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
Scope: local
bookworm: resolved (fixed in 1.1.5+ds1-1)
bullseye: resolved (fixed in 1.0.0~rc93+ds1-5+deb11u5)
forky: resolved (fixed in 1.1.5+ds1-1)
sid: resolved (fixed in 1.1.5+ds1-1)
trixie: resolved (fixed in 1.1.5+ds1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334https://github.com/opencontainers/runc/issues/3751https://lists.debian.org/debian-lts-announce/2023/03/msg00023.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334https://github.com/opencontainers/runc/issues/3751https://lists.debian.org/debian-lts-announce/2023/03/msg00023.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/https://security.netapp.com/advisory/ntap-20241206-0004/
2023-03-03
Published