An update of the runc package has been released.

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the nerdctl package has been released.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1650 advisory.

  - runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6e6d9065e0 advisory.

    Add commit c0be1aa2d101dcd3074b5a0e486d58d3f9568d81 as a patch for github.com/containers/common

    ----

    Security fix for CVE-2023-27561     Update to 1.1.8

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for docker-runc fixes the following issues :

  - CVE-2019-19921: Fixed a volume mount race condition with     shared mounts (bsc#1160452).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0688 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * runc: volume mount race condition with shared mounts led to information leak/integrity manipulation     (CVE-2019-19921)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0695 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-21 (runC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in runC. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker, by running a malicious Docker image, could escape the       container, bypass security restrictions, escalate privileges or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0110 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-5736:
    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2019-14378:
    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment.

    CVE-2019-16884:
    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory.

    CVE-2019-19921:
    runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.)

    CVE-2020-1983:
    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service.

    CVE-2020-7039:
    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code.

    CVE-2020-8608:
    In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code.

    CVE-2020-10756:
    An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1.

    CVE-2021-3595:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-20188:
    A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0110 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-5736:
    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the abilityto execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2019-14378:
    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment.

    CVE-2019-16884:
    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory.

    CVE-2019-19921:
    runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.)

    CVE-2020-1983:
    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service.

    CVE-2020-7039:
    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code.

    CVE-2020-8608:
    In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code.

    CVE-2020-10756:
    An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before4.3.1.

    CVE-2021-3595:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability isto data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-20188:
    A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
137201	Photon OS 3.0: Runc PHSA-2020-3.0-0102	Nessus	PhotonOS Local Security Checks	6/7/2020	8/22/2025	high
160173	EulerOS 2.0 SP8 : docker-engine (EulerOS-SA-2022-1585)	Nessus	Huawei Local Security Checks	4/25/2022	4/25/2022	high
179520	EulerOS 2.0 SP9 : docker-runc (EulerOS-SA-2023-2581)	Nessus	Huawei Local Security Checks	8/8/2023	8/8/2023	high
204563	Photon OS 4.0: Nerdctl PHSA-2023-4.0-0433	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	high
145798	CentOS 8 : container-tools:rhel8 (CESA-2020:1650)	Nessus	CentOS Local Security Checks	2/1/2021	2/8/2023	high
179884	Fedora 38 : golang-github-opencontainers-runc (2023-6e6d9065e0)	Nessus	Fedora Local Security Checks	8/16/2023	11/14/2024	high
133714	openSUSE Security Update : docker-runc (openSUSE-2020-219)	Nessus	SuSE Local Security Checks	2/14/2020	2/27/2020	high
134391	RHEL 8 : OpenShift Container Platform 4.2.22 runc (RHSA-2020:0688)	Nessus	Red Hat Local Security Checks	3/11/2020	11/7/2024	high
134557	RHEL 8 : OpenShift Container Platform 4.1.38 (RHSA-2020:0695)	Nessus	Red Hat Local Security Checks	3/13/2020	11/7/2024	high
134598	GLSA-202003-21 : runC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	3/16/2020	3/22/2024	high
236506	Alibaba Cloud Linux 3 : 0110: container-tools:rhel8 (ALINUX3-SA-2022:0110)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/15/2025	high
276379	TencentOS Server 3: container-tools:rhel8 (TSSA-2022:0110)	Nessus	Tencent Local Security Checks	11/20/2025	3/10/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high