runc - security update

Fixed packages 1

Vulnerabilities 6

• High 7.6
  CVE-2021-30465 EPSS 10%

  mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs

  runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange a…

  buildah k3s runc github.com/opencontainers/runc Debian Ubuntu Azure Linux Alpine Go
  May 27, 2021
• High 7.5
  CVE-2019-16884

  Incorrect Authorization in runc

  runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

  containerd runc github.com/opencontainers/runc runc Debian Ubuntu Alpine Go
  Sep 25, 2019
• High 7.0
  CVE-2023-27561

  Opencontainers runc Incorrect Authorization vulnerability

  runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom …

  ctop podman podman-doc github.com/opencontainers/runc Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 3, 2023
• Medium 6.1
  CVE-2023-28642

  AppArmor bypass with symlinked /proc in runc

  runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…

  opencontainers runc ctop podman Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 29, 2023
• Medium 5.9
  CVE-2019-19921

  opencontainers runc contains procfs race condition with a shared volume mount

  runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run cus…

  containerd runc github.com/opencontainers/runc runc Debian Ubuntu Alpine Go
  Feb 12, 2020
• Medium 5.9
  CVE-2022-29162

  Incorrect Default Permissions in runc

  runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an aty…

  opencontainers runc ctop podman Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 17, 2022