{"id":"CVE-2019-19921","published":"2020-02-12T00:00:00Z","modified":"2024-08-05T02:32:09Z","title":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to…","vendor":null,"product":null,"tier":"tail","description":{"text":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00433,"percentile":0.3761,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/opencontainers/runc/releases","tags":[]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19921","tags":[]},{"url":"https://github.com/opencontainers/runc/issues/2197","tags":[]},{"url":"https://github.com/opencontainers/runc/pull/2190","tags":[]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html","tags":["vendor-advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0688","tags":["vendor-advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0695","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202003-21","tags":["vendor-advisory"]},{"url":"https://usn.ubuntu.com/4297-1/","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/","tags":["vendor-advisory"]}],"priority":{"score":7.5,"factors":[{"name":"EPSS percentile","points":7.52}]},"affected":[{"ecosystem":"Go","package":"github.com/opencontainers/runc","vulnerableRanges":["<1.0.0-rc9.0.20200122160610-2fc03cc11c77"],"patched":["1.0.0-rc9.0.20200122160610-2fc03cc11c77"],"from":["GHSA-fh74-hm69-rqjw","GO-2021-0087"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1060","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencontainers-runc-cve-2016-9962","children":[{"from":"CVE-2019-19921","to":"CVE-2021-30465","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.0.0-rc9.0.20200122160610-2fc03cc11c77","toFixed":"1.0.0-rc95","daysApart":470},{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/2fc03cc11c775b7a8b2e48d7ee447cb9bef32ad0","https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f"],"basis":"shared function","functions":["mountToRootfs"]}]},{"from":"CVE-2019-19921","to":"CVE-2023-27561","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"NOTE: this issue exists because of a CVE-2019-19921 regression.","from":"CVE.org","in":"CVE-2023-27561"},{"kind":"similar","provenance":"machine","score":0.82,"basis":"same package + description similarity"}]},{"from":"CVE-2019-19921","to":"CVE-2025-52881","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-cgrx-mc8f-2prm","via":"reference","url":"https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw"},{"kind":"osv-related","provenance":"source","id":"GO-2025-4098","via":"reference","url":"https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw"}]},{"from":"CVE-2019-19921","to":"CVE-2025-64750","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-fh74-hm69-rqjw","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-wwrx-w7c9-rf87","via":"reference","url":"https://github.com/advisories/GHSA-fh74-hm69-rqjw"},{"kind":"osv-related","provenance":"source","id":"GO-2025-4177","via":"reference","url":"https://github.com/advisories/GHSA-fh74-hm69-rqjw"}]},{"from":"CVE-2019-19921","to":"CVE-2021-43784","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/2fc03cc11c775b7a8b2e48d7ee447cb9bef32ad0","https://github.com/opencontainers/runc/commit/9c444070ec7bb83995dbc0185da68284da71c554","https://github.com/opencontainers/runc/commit/d72d057ba794164c3cce9451a00b72a78b25e1ae"],"basis":"shared function","functions":["mountToRootfs"]}]},{"from":"CVE-2019-19921","to":"CVE-2024-45310","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/2fc03cc11c775b7a8b2e48d7ee447cb9bef32ad0","https://github.com/opencontainers/runc/commit/63c2908164f3a1daea455bf5bcd8d363d70328c7","https://github.com/opencontainers/runc/commit/8781993968fd964ac723ff5f360b6f259e809a3e"],"basis":"shared function","functions":["mountToRootfs"]}]}],"packageHistory":[{"cve":"CVE-2016-3697","published":"2016-06-01","fixed":"0.1.0","kev":false},{"cve":"CVE-2016-9962","published":"2017-01-31","fixed":"1.0.0-rc3","kev":false},{"cve":"CVE-2019-16884","published":"2019-09-25","fixed":"1.0.0-rc8.0.20190930145003-cad42f6e0932","kev":false,"link":{"from":"CVE-2019-16884","to":"CVE-2019-19921","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.0.0-rc8.0.20190930145003-cad42f6e0932","toFixed":"1.0.0-rc9.0.20200122160610-2fc03cc11c77","daysApart":140}]}},{"cve":"CVE-2019-19921","published":"2020-02-12","fixed":"1.0.0-rc9.0.20200122160610-2fc03cc11c77","kev":false},{"cve":"CVE-2021-30465","published":"2021-05-27","fixed":"1.0.0-rc95","kev":false},{"cve":"CVE-2021-43784","published":"2021-12-06","fixed":"1.1.0","kev":false},{"cve":"CVE-2022-29162","published":"2022-05-17","fixed":"1.1.2","kev":false}],"package":"Go:github.com/opencontainers/runc"}}