Search for packages
| purl | pkg:deb/debian/runc@0.1.1%2Bdfsg1-1~bpo8%2B1 |
| Next non-vulnerable version | 1.0.3+ds1-1 |
| Latest non-vulnerable version | 1.1.15+ds1-2 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5wce-1ywg-aaam
Aliases: CVE-2019-19921 GHSA-fh74-hm69-rqjw |
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.) |
Affected by 10 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-6j4q-p114-aaae
Aliases: CVE-2023-28642 GHSA-g2j6-57v7-gm8c |
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image. |
Affected by 6 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. |
|
VCID-6myd-yj9t-aaae
Aliases: CVE-2021-30465 GHSA-c3xm-pvg7-gh7r |
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition. |
Affected by 10 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-78xd-zy32-aaas
Aliases: CVE-2023-25809 GHSA-m8cg-xc2p-r3fc |
runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. |
Affected by 6 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. |
|
VCID-f21p-csu2-aaar
Aliases: CVE-2022-29162 GHSA-f3fp-gc8g-vw66 |
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file. |
Affected by 6 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-funr-5s9t-aaak
Aliases: CVE-2016-9962 GHSA-gp4j-w3vj-7299 |
RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container. |
Affected by 10 other vulnerabilities. |
|
VCID-h2d7-ph2u-aaah
Aliases: CVE-2024-21626 GHSA-xr7r-f8xq-vfvv |
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue. |
Affected by 6 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-rtmc-4r84-aaas
Aliases: CVE-2019-5736 |
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe. |
Affected by 9 other vulnerabilities. |
|
VCID-sxre-t5g1-aaaj
Aliases: CVE-2023-27561 GHSA-vpvm-3wq2-2wvm |
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression. |
Affected by 6 other vulnerabilities. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. |
|
VCID-us2v-fh9z-aaaa
Aliases: CVE-2021-43784 GHSA-v95c-p5hm-xq8f |
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug. |
Affected by 6 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. |
|
VCID-vvs4-9r5v-aaap
Aliases: CVE-2019-16884 GHSA-fgv8-vj5c-2ppq |
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory. |
Affected by 10 other vulnerabilities. Affected by 6 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-06-21T17:15:22.347795+00:00 | Debian Oval Importer | Affected by | VCID-rtmc-4r84-aaas | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T17:12:25.935670+00:00 | Debian Oval Importer | Affected by | VCID-funr-5s9t-aaak | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T17:00:04.259355+00:00 | Debian Oval Importer | Affected by | VCID-vvs4-9r5v-aaap | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T16:20:40.155423+00:00 | Debian Oval Importer | Affected by | VCID-sxre-t5g1-aaaj | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T14:36:39.639995+00:00 | Debian Oval Importer | Affected by | VCID-6j4q-p114-aaae | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T14:22:57.183516+00:00 | Debian Oval Importer | Affected by | VCID-5wce-1ywg-aaam | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T13:50:26.688222+00:00 | Debian Oval Importer | Affected by | VCID-f21p-csu2-aaar | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T13:14:32.418289+00:00 | Debian Oval Importer | Affected by | VCID-6myd-yj9t-aaae | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T07:52:54.716033+00:00 | Debian Oval Importer | Affected by | VCID-6j4q-p114-aaae | None | 36.1.3 |
| 2025-06-21T07:52:36.868504+00:00 | Debian Oval Importer | Affected by | VCID-sxre-t5g1-aaaj | None | 36.1.3 |
| 2025-06-21T04:51:46.439578+00:00 | Debian Oval Importer | Affected by | VCID-f21p-csu2-aaar | None | 36.1.3 |
| 2025-06-21T03:12:52.793859+00:00 | Debian Oval Importer | Affected by | VCID-vvs4-9r5v-aaap | None | 36.1.3 |
| 2025-06-21T01:55:18.253029+00:00 | Debian Oval Importer | Affected by | VCID-5wce-1ywg-aaam | None | 36.1.3 |
| 2025-06-21T01:41:58.483350+00:00 | Debian Oval Importer | Affected by | VCID-6myd-yj9t-aaae | None | 36.1.3 |
| 2025-06-21T00:34:30.801422+00:00 | Debian Oval Importer | Affected by | VCID-funr-5s9t-aaak | None | 36.1.3 |
| 2025-06-20T22:16:02.881970+00:00 | Debian Oval Importer | Affected by | VCID-rtmc-4r84-aaas | None | 36.1.3 |
| 2025-06-08T13:06:13.327430+00:00 | Debian Oval Importer | Affected by | VCID-6myd-yj9t-aaae | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.1.0 |
| 2025-06-08T12:41:25.849622+00:00 | Debian Oval Importer | Affected by | VCID-funr-5s9t-aaak | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.1.0 |
| 2025-06-08T11:53:33.749097+00:00 | Debian Oval Importer | Affected by | VCID-vvs4-9r5v-aaap | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.1.0 |
| 2025-06-08T09:56:48.846598+00:00 | Debian Oval Importer | Affected by | VCID-rtmc-4r84-aaas | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T09:54:06.740907+00:00 | Debian Oval Importer | Affected by | VCID-funr-5s9t-aaak | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T09:45:08.295303+00:00 | Debian Oval Importer | Affected by | VCID-vvs4-9r5v-aaap | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T09:06:49.743284+00:00 | Debian Oval Importer | Affected by | VCID-sxre-t5g1-aaaj | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T07:29:46.097218+00:00 | Debian Oval Importer | Affected by | VCID-6j4q-p114-aaae | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T07:16:01.884822+00:00 | Debian Oval Importer | Affected by | VCID-5wce-1ywg-aaam | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T06:44:36.857943+00:00 | Debian Oval Importer | Affected by | VCID-f21p-csu2-aaar | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T06:09:12.390583+00:00 | Debian Oval Importer | Affected by | VCID-6myd-yj9t-aaae | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T01:33:22.398503+00:00 | Debian Oval Importer | Affected by | VCID-6j4q-p114-aaae | None | 36.1.0 |
| 2025-06-08T01:33:03.879214+00:00 | Debian Oval Importer | Affected by | VCID-sxre-t5g1-aaaj | None | 36.1.0 |
| 2025-06-07T22:28:59.831423+00:00 | Debian Oval Importer | Affected by | VCID-f21p-csu2-aaar | None | 36.1.0 |
| 2025-06-07T20:45:46.034283+00:00 | Debian Oval Importer | Affected by | VCID-vvs4-9r5v-aaap | None | 36.1.0 |
| 2025-06-07T19:18:43.546959+00:00 | Debian Oval Importer | Affected by | VCID-5wce-1ywg-aaam | None | 36.1.0 |
| 2025-06-07T19:05:06.691035+00:00 | Debian Oval Importer | Affected by | VCID-6myd-yj9t-aaae | None | 36.1.0 |
| 2025-06-07T17:57:08.462021+00:00 | Debian Oval Importer | Affected by | VCID-funr-5s9t-aaak | None | 36.1.0 |
| 2025-06-07T15:40:03.738004+00:00 | Debian Oval Importer | Affected by | VCID-rtmc-4r84-aaas | None | 36.1.0 |
| 2025-04-13T01:58:05.176549+00:00 | Debian Oval Importer | Affected by | VCID-sxre-t5g1-aaaj | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-13T01:56:29.607920+00:00 | Debian Oval Importer | Affected by | VCID-us2v-fh9z-aaaa | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-13T01:56:09.054168+00:00 | Debian Oval Importer | Affected by | VCID-6j4q-p114-aaae | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-13T01:55:03.459308+00:00 | Debian Oval Importer | Affected by | VCID-78xd-zy32-aaas | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T23:11:06.993009+00:00 | Debian Oval Importer | Affected by | VCID-us2v-fh9z-aaaa | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-12T23:09:53.289257+00:00 | Debian Oval Importer | Affected by | VCID-h2d7-ph2u-aaah | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-12T22:55:37.090806+00:00 | Debian Oval Importer | Affected by | VCID-h2d7-ph2u-aaah | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T22:08:42.700896+00:00 | Debian Oval Importer | Affected by | VCID-5wce-1ywg-aaam | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T21:35:14.335616+00:00 | Debian Oval Importer | Affected by | VCID-f21p-csu2-aaar | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T20:44:32.107003+00:00 | Debian Oval Importer | Affected by | VCID-rtmc-4r84-aaas | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T18:53:48.030305+00:00 | Debian Oval Importer | Affected by | VCID-6myd-yj9t-aaae | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T18:28:12.549025+00:00 | Debian Oval Importer | Affected by | VCID-funr-5s9t-aaak | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T17:38:39.152634+00:00 | Debian Oval Importer | Affected by | VCID-vvs4-9r5v-aaap | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-08T08:29:01.286761+00:00 | Debian Oval Importer | Affected by | VCID-rtmc-4r84-aaas | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T08:26:19.887369+00:00 | Debian Oval Importer | Affected by | VCID-funr-5s9t-aaak | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T08:17:29.238824+00:00 | Debian Oval Importer | Affected by | VCID-vvs4-9r5v-aaap | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T07:38:37.068793+00:00 | Debian Oval Importer | Affected by | VCID-sxre-t5g1-aaaj | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T06:02:34.676005+00:00 | Debian Oval Importer | Affected by | VCID-6j4q-p114-aaae | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T05:48:37.106007+00:00 | Debian Oval Importer | Affected by | VCID-5wce-1ywg-aaam | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T05:17:04.886083+00:00 | Debian Oval Importer | Affected by | VCID-f21p-csu2-aaar | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T04:41:15.253300+00:00 | Debian Oval Importer | Affected by | VCID-6myd-yj9t-aaae | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T00:05:43.825220+00:00 | Debian Oval Importer | Affected by | VCID-6j4q-p114-aaae | None | 36.0.0 |
| 2025-04-08T00:05:25.633670+00:00 | Debian Oval Importer | Affected by | VCID-sxre-t5g1-aaaj | None | 36.0.0 |
| 2025-04-07T21:00:35.590207+00:00 | Debian Oval Importer | Affected by | VCID-f21p-csu2-aaar | None | 36.0.0 |
| 2025-04-07T19:16:16.969140+00:00 | Debian Oval Importer | Affected by | VCID-vvs4-9r5v-aaap | None | 36.0.0 |
| 2025-04-07T17:56:32.491047+00:00 | Debian Oval Importer | Affected by | VCID-5wce-1ywg-aaam | None | 36.0.0 |
| 2025-04-07T17:42:59.021160+00:00 | Debian Oval Importer | Affected by | VCID-6myd-yj9t-aaae | None | 36.0.0 |
| 2025-04-07T16:34:01.256391+00:00 | Debian Oval Importer | Affected by | VCID-funr-5s9t-aaak | None | 36.0.0 |
| 2025-04-07T14:10:58.513094+00:00 | Debian Oval Importer | Affected by | VCID-rtmc-4r84-aaas | None | 36.0.0 |