Skip to content
OpenAdvisories
High USN-4867-1 2 CVEs

runc vulnerabilities

Published Aug 10, 2021 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that runC incorrectly checked mount targets. An attacker
with a malicious container image could possibly mount over the /proc
directory and escalate privileges. (CVE-2019-16884)

Etienne Champetier discovered that runC incorrectly checked mount targets.
An attacker with a malicious container image could possibly mount the host
filesystem into the container and escalate privileges. (CVE-2021-30465)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS runc 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2

Vulnerabilities 2

  • High 7.6
    CVE-2021-30465 EPSS 10%

    mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs

    runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange a…

    buildah k3s runc github.com/opencontainers/runc Debian Ubuntu Azure Linux Alpine Go
  • High 7.5
    CVE-2019-16884

    Incorrect Authorization in runc

    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

    containerd runc github.com/opencontainers/runc runc Debian Ubuntu Alpine Go

References

  • report
    https://ubuntu.com/security/CVE-2019-16884
  • report
    https://ubuntu.com/security/CVE-2021-30465