CVE-2019-19921
HIGHCVSS 7/10EPSS 0.46%
Last modified
CVE-2019-19921 is a high-severity vulnerability rated 7/10 on the CVSS scale. runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Linuxfoundation | Runc | <= 0.1.1 | — |
| Linuxfoundation | Runc | 1.0.0 | Rc1 |
| Debian | Debian Linux | 9.0 | — |
| Debian | Debian Linux | 10.0 | — |
| Opensuse | Leap | 15.1 | — |
| Canonical | Ubuntu Linux | 18.04 | — |
| Canonical | Ubuntu Linux | 19.10 | — |
| Redhat | Openshift Container Platform | 4.1 | — |
| Redhat | Openshift Container Platform | 4.2 | — |
References
- https://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.htmlBroken Link, Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0688Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0695Third Party Advisory
- https://github.com/opencontainers/runc/issues/2197Issue Tracking, Patch, Third Party Advisory
- https://github.com/opencontainers/runc/pull/2190Issue Tracking, Third Party Advisory
- https://github.com/opencontainers/runc/releasesThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2019-19921Third Party Advisory
- https://security.gentoo.org/glsa/202003-21Third Party Advisory
- https://usn.ubuntu.com/4297-1/Third Party Advisory
- https://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.htmlBroken Link, Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0688Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0695Third Party Advisory
- https://github.com/opencontainers/runc/issues/2197Issue Tracking, Patch, Third Party Advisory
- https://github.com/opencontainers/runc/pull/2190Issue Tracking, Third Party Advisory
- https://github.com/opencontainers/runc/releasesThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2019-19921Third Party Advisory
- https://security.gentoo.org/glsa/202003-21Third Party Advisory
- https://usn.ubuntu.com/4297-1/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-19921?
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)
How severe is CVE-2019-19921?
CVE-2019-19921 has a CVSS score of 7/10 (HIGH severity). The EPSS model estimates a 0.46% probability of exploitation in the next 30 days.
How do I fix CVE-2019-19921?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-19916In Midori Browser 0.5.11 (on Windows 10), Content Security P…6.1
- CVE-2019-19917Lout 3.40 has a buffer overflow in the StringQuotedWord() fu…7.8
- CVE-2019-19918Lout 3.40 has a heap-based buffer overflow in the srcnext() …7.8
- CVE-2019-19919Versions of handlebars prior to 4.3.0 are vulnerable to Prot…9.8
- CVE-2019-1992In bta_hl_sdp_query_results of bta_hl_main.cc, there is a po…
- CVE-2019-19920sa-exim 4.2.1 allows attackers to execute arbitrary code if …8.8
- CVE-2019-19922kernel/sched/fair.c in the Linux kernel before 5.3.9, when c…5.5
- CVE-2019-19923flattenSubquery in select.c in SQLite 3.30.1 mishandles cert…7.5
- CVE-2019-19924SQLite 3.30.1 mishandles certain parser-tree rewriting, rela…5.3
- CVE-2019-19925zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishand…7.5
- CVE-2019-19926multiSelect in select.c in SQLite 3.30.1 mishandles certain …7.5
- CVE-2019-19927In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linu…6
Are you affected by CVE-2019-19921?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST