Opencontainers runc Incorrect Authorization vulnerability

HIGH 7.0CVE-2023-27561 · GHSA-vpvm-3wq2-2wvm · GO-2023-1627 · Published 03/03/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/opencontainers/runc Go	`≥ 1.0.0-rc95, < 1.1.5`	`1.1.5`
runc linuxfoundation	`< 1.1.5`	`1.1.5`
openshift container platform redhat	`= 4.0`	No fix yet

Description

runc 1.0.0-rc95 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

NVD description

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free