Detections
Analytics

SCA: security update for github.com/opencontainers/runc (GHSA-v95c-p5hm-xq8f)

medium Tenable Cloud Security Plugin ID 419220

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In
 runc, netlink is used internally as a serialization system for specifying the relevant container
 configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In
 all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in
 the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte
 array attribute could result in the length overflowing and the attribute contents being parsed as netlink
 messages for container configuration. This vulnerability requires the attacker to have some control over
 the configuration of the container and would allow the attacker to bypass the namespace restrictions of
 the container by simply adding their own netlink payload which disables all namespaces. The main users
 impacted are those who allow untrusted images with untrusted configurations to run on their machines (such
 as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one
 may try disallowing untrusted namespace paths from your container. It should be noted that untrusted
 namespace paths would allow the attacker to disable namespace protections entirely even in the absence of
 this bug. (CVE-2021-43784)

See Also

https://github.com/advisories/GHSA-v95c-p5hm-xq8f

Plugin Details

Severity: Medium

ID: 419220

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.8

Percentile: 56.9

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2021-43784

CVSS v3

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.5

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/7/2021

Vulnerability Publication Date: 12/6/2021

Reference Information

CVE: CVE-2021-43784

cwe: CWE-190