Lucene search
Alpine Linux Development TeamALPINE:CVE-2023-27561HistoryMar 03, 2023 - 7:15 p.m.
CVE-2023-27561
2023-03-0319:15:11
Alpine Linux Development Team
security.alpinelinux.org
17
runc 1.1.4
incorrect access control
privilege escalation
custom containers
cve-2023-27561
4.4 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
7 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.6 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
19.2%
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Alpine | edge-community | noarch | runc | < 1.1.4-r0 | UNKNOWN |
| Alpine | edge-community | noarch | runc | < 1.1.4-r7 | UNKNOWN |
| Alpine | 3.17-community | noarch | runc | < 1.1.4-r6 | UNKNOWN |
| Alpine | 3.17-community | noarch | runc | < 1.1.5-r0 | UNKNOWN |
| Alpine | 3.18-community | noarch | runc | < 1.1.4-r0 | UNKNOWN |
| Alpine | 3.18-community | noarch | runc | < 1.1.4-r7 | UNKNOWN |
| Alpine | 3.19-community | noarch | runc | < 1.1.4-r0 | UNKNOWN |
| Alpine | 3.19-community | noarch | runc | < 1.1.4-r7 | UNKNOWN |
| Alpine | 3.20-community | noarch | runc | < 1.1.4-r0 | UNKNOWN |
| Alpine | 3.20-community | noarch | runc | < 1.1.4-r7 | UNKNOWN |
Related
fedora
fedora
[SECURITY] Fedora 37 Update: runc-1.1.6-1.fc37
2023-04-21 02:11:21
[SECURITY] Fedora 38 Update: runc-1.1.6-1.fc38
2023-04-21 02:09:44
[SECURITY] Fedora 36 Update: runc-1.1.6-1.fc36
2023-04-21 01:25:12
cvelist
cvelist
CVE-2023-27561
2023-03-03 00:00:00
CVE-2019-19921
2020-02-12 00:00:00
redhatcve
redhatcve
CVE-2023-27561
2023-03-06 12:59:47
CVE-2019-19921
2020-01-29 16:31:25
ubuntucve
ubuntucve
CVE-2023-27561
2023-03-03 00:00:00
CVE-2019-19921
2020-02-12 00:00:00
veracode
veracode
Sandbox Restrictions Bypass
2023-03-08 02:33:46
Sandbox Restrictions Bypass
2020-01-16 05:48:35
nessus
nessus
Fedora 37 : runc (2023-1ba499965f)
2023-04-21 00:00:00
EulerOS 2.0 SP10 : docker-runc (EulerOS-SA-2023-1818)
2023-05-09 00:00:00
Fedora 36 : runc (2023-1bcbb1db39)
2023-04-21 00:00:00
openvas
openvas
Huawei EulerOS: Security Advisory for docker-runc (EulerOS-SA-2023-1818)
2023-05-09 00:00:00
Huawei EulerOS: Security Advisory for docker-runc (EulerOS-SA-2023-1800)
2023-05-09 00:00:00
Fedora: Security Advisory for runc (FEDORA-2023-1bcbb1db39)
2023-04-23 00:00:00
nvd
nvd
CVE-2023-27561
2023-03-03 19:15:11
CVE-2019-19921
2020-02-12 15:15:12
github
github
Opencontainers runc Incorrect Authorization vulnerability
2023-03-03 21:30:19
runc AppArmor bypass with symlinked /proc
2023-03-30 20:20:23
cve
cve
CVE-2023-27561
2023-03-03 19:15:11
CVE-2019-19921
2020-02-12 15:15:12
vulnrichment
vulnrichment
CVE-2023-27561
2023-03-03 00:00:00
osv
osv
CVE-2023-27561
2023-03-03 19:15:11
Opencontainers runc Incorrect Authorization vulnerability
2023-03-03 21:30:19
Race condition in github.com/opencontainers/runc
2021-04-14 20:04:52
prion
prion
Design/Logic Flaw
2023-03-03 19:15:00
Improper access control
2020-02-12 15:15:00
debiancve
debiancve
CVE-2023-27561
2023-03-03 19:15:11
CVE-2019-19921
2020-02-12 15:15:12
mageia
mageia
Updated opencontainers-runc packages fix security vulnerability
2023-04-07 00:20:12
Updated opencontainers-runc packages fix security vulnerability
2020-02-26 13:21:01
debian
debian
[SECURITY] [DLA 3369-1] runc security update
2023-03-27 16:07:07
altlinux
altlinux
Security fix for the ALT Linux 10 package runc version 1.0.0-alt12.rc10
2020-02-17 00:00:00
Security fix for the ALT Linux 10 package runc version 1.1.5-alt1
2023-04-20 00:00:00
redhat
redhat
(RHSA-2020:0942) Moderate: runc security update
2020-03-23 13:32:09
alpinelinux
alpinelinux
CVE-2019-19921
2020-02-12 15:15:12
photon
photon
Home
Download Photon OS
User Documentation
FAQ
Security Advisories
Related Information
Lightwave - PHSA-2020-2.0-0275
2020-08-22 00:00:00
Important Photon OS Security Update - PHSA-2023-5.0-0038
2023-06-27 00:00:00
Important Photon OS Security Update - PHSA-2020-0275
2020-08-22 00:00:00
suse
suse
Security update for docker-runc (moderate)
2020-02-13 00:00:00
amazon
amazon
Medium: runc
2020-04-20 18:58:00
cbl_mariner
cbl_mariner
CVE-2023-27561 affecting package moby-runc 1.1.2+azure-4
2023-04-20 19:17:28
CVE-2023-27561 affecting package moby-runc for versions less than 1.1.5-1
2023-05-03 16:08:49
cgr
cgr
CVE-2023-27561 vulnerabilities
2024-05-19 03:07:16
wolfi
wolfi
CVE-2023-27561 vulnerabilities
2024-06-29 09:08:33
ubuntu
ubuntu
runC vulnerabilities
2023-05-23 00:00:00
runC vulnerabilities
2020-03-09 00:00:00
runC vulnerabilities
2023-05-18 00:00:00
almalinux
almalinux
Moderate: runc security update
2023-11-07 00:00:00
Moderate: container-tools:rhel8 security, bug fix, and enhancement update
2020-04-28 09:01:00
Moderate: container-tools:4.0 security and bug fix update
2023-11-14 00:00:00
oraclelinux
oraclelinux
container-tools:ol8 security update
2020-05-12 00:00:00
container-tools:ol8 security, bug fix, and enhancement update
2020-05-05 00:00:00
buildah security update
2023-07-19 00:00:00
ibm
ibm
Security Bulletin: IBM Cloud Kubernetes Service is affected by two containerd security vulnerabilities (CVE-2023-28642) (CVE-2023-27561)
2023-06-12 12:41:31
Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Open Container Initiative runc
2024-06-28 22:49:49
Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs
2023-05-31 17:22:48
rocky
rocky
container-tools:rhel8 security, bug fix, and enhancement update
2020-04-28 09:01:00
rosalinux
rosalinux
Advisory ROSA-SA-2024-2393
2024-04-11 07:16:35
Advisory ROSA-SA-2023-2209
2023-08-08 07:51:13
gentoo
gentoo
runC: Multiple vulnerabilities
2020-03-15 00:00:00
4.4 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
7 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.6 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
19.2%
Related for ALPINE:CVE-2023-27561