runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the runc-1.1.7-2.el9 build changelog.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0564 advisory.

  - prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

  - runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6939 advisory.

  - Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be     escaped to not be. This could lead to an XSS attack. (CVE-2023-3978)

  - Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing     whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts     that also contain actions may not be properly sanitized during execution. (CVE-2023-24540)

  - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient     to cause a denial of service from a small number of small requests. (CVE-2022-41723)

  - Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them     as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template     action within a Javascript template literal, the contents of the action can be used to terminate the     literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather     complex, and themselves can do string interpolation, the decision was made to simply disallow Go template     actions from being used inside of them (e.g. var a = {{.}}), since there is no obviously safe way to     allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse     returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is     currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous     behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will     now be escaped. This should be used with caution. (CVE-2023-24538)

  - containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and     1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct     access to a container and manipulates their supplementary group access, they may be able to use     supplementary group access to bypass primary group restrictions in some cases, potentially gaining access     to sensitive information or gaining the ability to execute code in that container. Downstream applications     that use the containerd client library may be affected as well. This bug has been fixed in containerd     v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue.
    Users who rely on a downstream application that uses containerd's client library should check that     application for a separate advisory and instructions. As a workaround, ensure that the `USER $USERNAME`     Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to     `ENTRYPOINT [su, -, user]` to allow `su` to properly set up supplementary groups. (CVE-2023-25173)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. (CVE-2022-3064)

  - Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing     very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the     total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed,     leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased     pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3.
    ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage     collector. The combination of these factors can permit an attacker to cause an program that parses     multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service.
    This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http     package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix,     ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many     fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits     on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit     may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with     NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with     ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with     the environment variable GODEBUG=multipartmaxheaders=. (CVE-2023-24536)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - Calling any of the Parse functions on Go source code which contains //line directives with very large line     numbers can cause an infinite loop due to integer overflow. (CVE-2023-24537)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

  - Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can     result in output with unexpected results when parsed due to HTML normalization rules. This may allow     injection of arbitrary attributes into tags. (CVE-2023-29400)

  - HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs,     potentially leading to a denial of service. Certain unusual patterns of input data can cause the common     function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold     the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large     amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.
    With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
    (CVE-2023-24534)

  - Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates     containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS     context and allowing for injection of unexpected HTML, if executed with untrusted input. (CVE-2023-24539)

  - A denial of service is possible from excessive resource consumption in net/http and mime/multipart.
    Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory     and disk files. This also affects form parsing in the net/http package with the Request methods FormFile,     FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented     as storing up to maxMemory bytes +10MB (reserved for non-file parts) in memory. File parts which cannot     be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file     parts is excessively large and can potentially open a denial of service vector on its own. However,     ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead,     part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In     addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small     request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts     for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory     bytes of memory consumption. Users should still be aware that this limit is high and may still be     hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form     parts into a single temporary file. The mime/multipart.File interface type's documentation states, If     stored on disk, the File's underlying concrete type will be an *os.File.. This is no longer the case when     a form contains more than one file part, due to this coalescing of parts into a single file. The previous     behavior of using distinct files for each form part may be reenabled with the environment variable     GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request     methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the     size of form data with http.MaxBytesReader. (CVE-2022-41725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6938 advisory.

  - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

  - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient     to cause a denial of service from a small number of small requests. (CVE-2022-41723)

  - Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be     escaped to not be. This could lead to an XSS attack. (CVE-2023-3978)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can     result in output with unexpected results when parsed due to HTML normalization rules. This may allow     injection of arbitrary attributes into tags. (CVE-2023-29400)

  - Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. (CVE-2022-3064)

  - HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs,     potentially leading to a denial of service. Certain unusual patterns of input data can cause the common     function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold     the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large     amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.
    With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
    (CVE-2023-24534)

  - Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing     very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the     total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed,     leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased     pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3.
    ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage     collector. The combination of these factors can permit an attacker to cause an program that parses     multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service.
    This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http     package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix,     ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many     fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits     on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit     may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with     NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with     ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with     the environment variable GODEBUG=multipartmaxheaders=. (CVE-2023-24536)

  - Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them     as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template     action within a Javascript template literal, the contents of the action can be used to terminate the     literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather     complex, and themselves can do string interpolation, the decision was made to simply disallow Go template     actions from being used inside of them (e.g. var a = {{.}}), since there is no obviously safe way to     allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse     returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is     currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous     behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will     now be escaped. This should be used with caution. (CVE-2023-24538)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - A denial of service is possible from excessive resource consumption in net/http and mime/multipart.
    Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory     and disk files. This also affects form parsing in the net/http package with the Request methods FormFile,     FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented     as storing up to maxMemory bytes +10MB (reserved for non-file parts) in memory. File parts which cannot     be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file     parts is excessively large and can potentially open a denial of service vector on its own. However,     ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead,     part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In     addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small     request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts     for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory     bytes of memory consumption. Users should still be aware that this limit is high and may still be     hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form     parts into a single temporary file. The mime/multipart.File interface type's documentation states, If     stored on disk, the File's underlying concrete type will be an *os.File.. This is no longer the case when     a form contains more than one file part, due to this coalescing of parts into a single file. The previous     behavior of using distinct files for each form part may be reenabled with the environment variable     GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request     methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the     size of form data with http.MaxBytesReader. (CVE-2022-41725)

  - Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing     whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts     that also contain actions may not be properly sanitized during execution. (CVE-2023-24540)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - Calling any of the Parse functions on Go source code which contains //line directives with very large line     numbers can cause an infinite loop due to integer overflow. (CVE-2023-24537)

  - Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates     containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS     context and allowing for injection of unexpected HTML, if executed with untrusted input. (CVE-2023-24539)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-6380 advisory.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6938 advisory.

  - go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)

  - net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

  - golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

  - golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

  - golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

  - golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

  - golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

  - golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

  - golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

  - golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

  - runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

  - runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

  - runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

  - golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

  - golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6939 advisory.

  - go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)

  - net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

  - golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

  - golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

  - golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

  - golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

  - golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

  - golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

  - golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

  - golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

  - containerd: Supplementary groups are not set up properly (CVE-2023-25173)

  - runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

  - runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

  - runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

  - golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

  - golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6380 advisory.

  - runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container     configuration (CVE-2021-43784)

  - golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

  - runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

  - runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

  - runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12579 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12578 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-004 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-208 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-025 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-024 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6088-2 advisory.

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug     was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty     inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with     inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This     bug did not affect the container security sandbox as the inheritable set never contained more capabilities     than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix     changes `runc exec --cap` behavior such that the additional capabilities granted to the process being     executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc     spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`)     file. (CVE-2022-29162)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6088-1 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2003-1 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1726-1 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191389	CentOS 9 : runc-1.1.7-2.el9	Nessus	CentOS Local Security Checks	high
189807	RHEL 8 : container-tools:3.0 (RHSA-2024:0564)	Nessus	Red Hat Local Security Checks	high
189050	EulerOS 2.0 SP11 : docker-runc (EulerOS-SA-2023-2638)	Nessus	Huawei Local Security Checks	high
188882	EulerOS 2.0 SP11 : docker-runc (EulerOS-SA-2023-2680)	Nessus	Huawei Local Security Checks	high
186122	Oracle Linux 8 : container-tools:ol8 (ELSA-2023-6939)	Nessus	Oracle Linux Local Security Checks	critical
186113	Oracle Linux 8 : container-tools:4.0 (ELSA-2023-6938)	Nessus	Oracle Linux Local Security Checks	critical
185838	Oracle Linux 9 : runc (ELSA-2023-6380)	Nessus	Oracle Linux Local Security Checks	high
185685	RHEL 8 : container-tools:4.0 (RHSA-2023:6938)	Nessus	Red Hat Local Security Checks	critical
185675	RHEL 8 : container-tools:rhel8 (RHSA-2023:6939)	Nessus	Red Hat Local Security Checks	critical
185109	RHEL 9 : runc (RHSA-2023:6380)	Nessus	Red Hat Local Security Checks	high
179555	EulerOS 2.0 SP9 : docker-runc (EulerOS-SA-2023-2611)	Nessus	Huawei Local Security Checks	high
179520	EulerOS 2.0 SP9 : docker-runc (EulerOS-SA-2023-2581)	Nessus	Huawei Local Security Checks	high
178585	Oracle Linux 8 : aardvark-dns (ELSA-2023-12579)	Nessus	Oracle Linux Local Security Checks	high
178580	Oracle Linux 8 : buildah (ELSA-2023-12578)	Nessus	Oracle Linux Local Security Checks	high
178288	Amazon Linux 2 : runc (ALASECS-2023-004)	Nessus	Amazon Linux Local Security Checks	high
177193	Amazon Linux 2023 : runc (ALAS2023-2023-208)	Nessus	Amazon Linux Local Security Checks	high
176771	Amazon Linux 2 : runc (ALASDOCKER-2023-025)	Nessus	Amazon Linux Local Security Checks	high
176752	Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2023-024)	Nessus	Amazon Linux Local Security Checks	high
176257	Ubuntu 16.04 ESM : runC vulnerabilities (USN-6088-2)	Nessus	Ubuntu Local Security Checks	high
176064	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 : runC vulnerabilities (USN-6088-1)	Nessus	Ubuntu Local Security Checks	high
174770	SUSE SLES15 / openSUSE 15 Security Update : runc (SUSE-SU-2023:2003-1)	Nessus	SuSE Local Security Checks	high
173902	SUSE SLES12 Security Update : runc (SUSE-SU-2023:1726-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-28642

high

Tenable Plugins

high

high

high

high

critical

critical

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high