runc: Regression of CVE-2019-19921: incorrect access control leading to privilege escalation via volume mounts

Impact

Regression of CVE-2019-19921: incorrect access control leading to privilege escalation via volume mounts

Who can reach it

Any tenant workload able to spawn two containers with custom mounts

What to do

Replace runc binary; drain node

References

Related entries

• runc: AppArmor bypass when /proc inside the container is symlinked with a specific mount configCVE-2023-28642 · runcMedium
• runc: Netlink bytemsg length integer overflow in libcontainer allows config injection / partial escapeCVE-2021-43784 · runcMedium
• runc: `runc exec --cap` created processes with non-empty inheritable capabilitiesCVE-2022-29162 · runcMedium
• runc: Rootless runc leaves /sys/fs/cgroup writable inside the containerCVE-2023-25809 · runcMedium
• runc: runc can be tricked into creating empty files/directories at arbitrary host locationsCVE-2024-45310 · runcLow
• runc: setupPtmx/setupDev rootfs setup flaw during container rootfs constructionCVE-2026-41579 · runcLow