CVE-2019-19921 - CVE House
Back to Database
Status published High CVE-2019-19921

runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation...

Vulnerability Description

runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-19921

Credits & Attribution

No credits recorded in the NVD database.

References

More from linuxfoundation

View All →
CVE-2022-46770
qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows...
Unknown 0
CVE-2022-46463
An access control issue in Harbor v1.X.X to v2.5.3 allows...
Unknown 0
CVE-2022-45932
A SQL injection issue was discovered in AAA in OpenDaylight...
Unknown 0
CVE-2022-45931
A SQL injection issue was discovered in AAA in OpenDaylight...
Unknown 0
CVE-2022-45930
A SQL injection issue was discovered in AAA in OpenDaylight...
Unknown 0

Affected Vendor

linuxfoundation

View all reports →

Affected Software

runc, debian linux, leap, ubuntu linux, openshift container platform
Vulnerable Versions:
0, 1.0.0, 9.0, 10.0, 15.1, 18.04, 19.10, 4.1, 4.2

Timeline

Official Publish: February 12th, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.