Detections
Analytics
Alpine: multiple runc packages: security update to 1.1.4-r0
high Tenable Cloud Security Plugin ID 407022
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- runc is a CLI tool for spawning and running containers according to the OCI specification. In affected
versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when
runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to
be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or
2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc
spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup
hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace
(`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl
on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)
- runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to
libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with
custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a
CVE-2019-19921 regression. (CVE-2023-27561)
- runc is a CLI tool for spawning and running containers according to the OCI specification. It was found
that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount
configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR
#3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted
container image. (CVE-2023-28642)
See Also
https://security.alpinelinux.org/vuln/CVE-2023-25809
Plugin Details
Severity: High
ID: 407022
Version: Revision 1.31
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 6.9
Percentile: 96.99
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2023-28642
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 7
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 3/3/2023