CVE-2019-19921

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-19921
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-19921.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-19921
Aliases
Downstream
Related
Published
2020-02-12T15:15:12.210Z
Modified
2026-04-11T12:20:04.425925Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "4.1"
                }
            ],
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "4.2"
                }
            ],
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:*"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "18.04"
                }
            ],
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "19.10"
                }
            ],
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "10.0"
                }
            ],
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "9.0"
                }
            ],
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "15.1"
                }
            ],
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
        }
    ]
}
References

Affected packages

Git / github.com/opencontainers/runc

Affected ranges

Type
GIT
Repo
https://github.com/opencontainers/runc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
baf6536d6259209c3edfa2b22237af82942d3dfa
Last affected
04f275d4601ca7e5ff9460cec7f65e8dd15443ec
Last affected
c91b5bea4830a57eac7882d7455d59518cdf70ec
Last affected
75f8da7c889acc4509a0cf6f0d3a8f9584778375
Last affected
2e7cfe036e2c6dc51ccca6eb7fa3ee6b63976dcd
Last affected
4fc53a81fb7c994640722ac585fa9ca548971871
Last affected
ccb5efd37fb7c86364786e9137e22948751de7ed
Last affected
69ae5da6afdcaaf38285a10b36f362e41cb298d6
Last affected
425e105d5a03fabd737a126ad93d62a9eeede87f
Last affected
d736ef14f0288d6993a1845745d6756cfc9ddd5a
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.1.1"
        },
        {
            "last_affected": "1.0.0-rc1"
        },
        {
            "last_affected": "1.0.0-rc2"
        },
        {
            "last_affected": "1.0.0-rc3"
        },
        {
            "last_affected": "1.0.0-rc4"
        },
        {
            "last_affected": "1.0.0-rc5"
        },
        {
            "last_affected": "1.0.0-rc6"
        },
        {
            "last_affected": "1.0.0-rc7"
        },
        {
            "last_affected": "1.0.0-rc8"
        },
        {
            "last_affected": "1.0.0-rc9"
        }
    ],
    "source": "CPE_FIELD",
    "cpe": [
        "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*",
        "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*",
        "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*",
        "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*",
        "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:*",
        "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:*",
        "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9:*:*:*:*:*:*"
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.1.0
v0.1.1
v1.*
v1.0.0-rc1
v1.0.0-rc2
v1.0.0-rc3
v1.0.0-rc4
v1.0.0-rc5
v1.0.0-rc6
v1.0.0-rc7
v1.0.0-rc8
v1.0.0-rc9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-19921.json"