runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202408-25 (runc: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in runc. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the runc package has been released.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the runc-1.1.7-2.el9 build changelog.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3735 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3735-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     February 19, 2024                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : runc     Version        : 1.0.0~rc6+dfsg1-3+deb10u3     CVE ID         : CVE-2021-43784 CVE-2024-21626     Debian Bug     :

    runc is a command line client for running applications packaged according     to the Open Container Format (OCF) and is a compliant implementation of     the Open Container Project specification.

    CVE-2021-43784

       A flaw has been detected that may lead to a possible length field        overflow, allowing user-controlled data to be parsed as control        characters.

    CVE-2024-21626

       A flaw has been detected which allows several container breakouts        due to internally leaked file descriptors. The patch includes fixes        and hardening measurements against these types of issues/attacks.

    For Debian 10 buster, these problems have been fixed in version     1.0.0~rc6+dfsg1-3+deb10u3.

    We recommend that you upgrade your runc packages.

    For the detailed security status of runc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/runc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

    Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-6380 advisory.

    - rebuild for following CVEs:
    CVE-2021-43784 CVE-2022-41724 CVE-2023-28642
    - runc 1.1.5 resolves CVE-2023-25809 and CVE-2023-27561

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6380 advisory.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    Security Fix(es):

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

    * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

    * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

    * runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based     container configuration (CVE-2021-43784)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6088-2 advisory.

    USN-6088-1 fixed vulnerabilities in runC. This update provides the corresponding updates for Ubuntu 16.04     LTS.

    It was discovered that runC incorrectly performed access control when mounting /proc to non-directories.
    An attacker could possibly use this issue to escalate privileges. (CVE-2019-19921)

    Felix Wilhelm discovered that runC incorrecly handled netlink

    messages. An attacker could possibly use this issue to escalate privileges. (CVE-2021-43784)

    Andrew G. Morgan discovered that runC incorrectly set inherited process capabilities inside the container.
    An attacker could possibly use this issue to escalate privileges. (CVE-2022-29162)



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - Moby is an open-source project created by Docker to enable software containerization. A bug was found in     Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container     can result in Unix file permission changes for existing files in the host's filesystem, widening access to     others. This bug does not directly allow files to be read, modified, or executed without an additional     cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this     version as soon as possible. Running containers do not need to be restarted. (CVE-2021-41089)

  - Moby is an open-source project created by Docker to enable software containerization. A bug was found in     Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with     insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory     contents and execute programs. When containers included executable programs with extended permission bits     (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an     unprivileged Linux user on the host collided with the file owner or group inside a container, the     unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed     in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running     containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade     limit access to the host to trusted users. Limit access to host volumes to trusted containers.
    (CVE-2021-41091)

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has docker-ce packages installed that are affected by a vulnerability:

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has docker-ce packages installed that are affected by a vulnerability:

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1625-1 advisory.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:4171-1 advisory.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:4171-1 advisory.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:4059-1 advisory.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2841 advisory.

    It was discovered that there was an overflow issue in runc, the runtime for the Open Container Project,     often used with Docker. The Netlink 'bytemsg' length field could have allowed an attacker to override     Netlink-based container configurations. This vulnerability required the attacker to have some control over     the configuration of the container, but would have allowed the attacker to bypass the namespace     restrictions of the container by simply adding their own Netlink payload which disables all namespaces.
    CVE-2021-43784 For Debian 9 Stretch, these problems have been fixed in version 0.1.1+dfsg1-2+deb9u3. We     recommend that you upgrade your runc packages. Further information about Debian LTS security advisories,     how to apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
224195	Linux Distros Unpatched Vulnerability : CVE-2021-43784	Nessus	Misc.	medium
205353	GLSA-202408-25 : runc: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
203959	Photon OS 3.0: Runc PHSA-2021-3.0-0345	Nessus	PhotonOS Local Security Checks	medium
203151	Photon OS 4.0: Runc PHSA-2022-4.0-0153	Nessus	PhotonOS Local Security Checks	medium
191389	CentOS 9 : runc-1.1.7-2.el9	Nessus	CentOS Local Security Checks	high
190686	Debian dla-3735 : golang-github-opencontainers-runc-dev - security update	Nessus	Debian Local Security Checks	high
185838	Oracle Linux 9 : runc (ELSA-2023-6380)	Nessus	Oracle Linux Local Security Checks	high
185109	RHEL 9 : runc (RHSA-2023:6380)	Nessus	Red Hat Local Security Checks	high
176257	Ubuntu 16.04 ESM : runC vulnerabilities (USN-6088-2)	Nessus	Ubuntu Local Security Checks	high
174054	NewStart CGSL CORE 5.05 / MAIN 5.05 : docker-ce Multiple Vulnerabilities (NS-SA-2023-0014)	Nessus	NewStart CGSL Local Security Checks	medium
167464	NewStart CGSL MAIN 6.02 : docker-ce Vulnerability (NS-SA-2022-0095)	Nessus	NewStart CGSL Local Security Checks	medium
160736	NewStart CGSL CORE 5.04 / MAIN 5.04 : docker-ce Vulnerability (NS-SA-2022-0020)	Nessus	NewStart CGSL Local Security Checks	medium
156579	Photon OS 3.0: Runc PHSA-2022-3.0-0345	Nessus	PhotonOS Local Security Checks	medium
156317	openSUSE 15 Security Update : runc (openSUSE-SU-2021:1625-1)	Nessus	SuSE Local Security Checks	medium
156289	SUSE SLES15 Security Update : runc (SUSE-SU-2021:4171-1)	Nessus	SuSE Local Security Checks	medium
156278	openSUSE 15 Security Update : runc (openSUSE-SU-2021:4171-1)	Nessus	SuSE Local Security Checks	medium
156086	SUSE SLES12 Security Update : runc (SUSE-SU-2021:4059-1)	Nessus	SuSE Local Security Checks	medium
155921	Debian DLA-2841-1 : runc - LTS security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2021-43784

medium

Tenable Plugins

medium

high

medium

medium

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium