| Package | Affected versions | Patched versions |
|---|---|---|
| mesos | ≥ 1.4.0, < 1.4.3≥ 1.5.0, < 1.5.3≥ 1.6.0, < 1.6.2≥ 1.7.0, < 1.7.2 | 1.4.31.5.31.6.21.7.2 |
| kubernetes engine | < 2.2.0-1.13.3 | 2.2.0-1.13.3 |
| docker | < 18.09.2 | 18.09.2 |
| lxc | < 3.2.0 | 3.2.0 |
| runc | = 1.0.0≤ 0.1.1 | |
| service management automation | = 2018.02= 2018.05= 2018.08= 2018.11 | |
| backports sle | = 15.0 | |
| container development kit | = 3.7 | |
| openshift | = 3.4= 3.5= 3.6= 3.7 |
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free