An update of the runc package has been released.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1ba499965f advisory.

    Security fix for CVE-2023-27561

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the runc-1.1.7-1.el9 build changelog.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-024 advisory.

    runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

    runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

    runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-208 advisory.

    runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

    runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

    runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-004 advisory.

    runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

    runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

    runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12578 advisory.

    - rootless: fix /sys/fs/cgroup mounts to prevent CVE-2023-25809
    - rootfs: prohibit symlinks that conflicts with readonlyPaths               and/or maskedPaths to prevent CVE-2023-27561
    - Prohibit /proc and /sys to be symlinks to prevent CVE-2023-28642

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12579 advisory.

    - rootless: fix /sys/fs/cgroup mounts to prevent CVE-2023-25809
    - rootfs: prohibit symlinks that conflicts with readonlyPaths               and/or maskedPaths to prevent CVE-2023-27561
    - Prohibit /proc and /sys to be symlinks to prevent CVE-2023-28642

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:6938 advisory.

    * go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)
    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
    * golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
    * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
    * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)
    * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
    * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
    * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
    * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)
    * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
    * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)
    * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
    * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202408-25 (runc: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in runc. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
204003	Photon OS 3.0: Runc PHSA-2023-3.0-0578	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	high
174603	Fedora 37 : runc (2023-1ba499965f)	Nessus	Fedora Local Security Checks	4/21/2023	11/14/2024	high
191195	CentOS 9 : runc-1.1.7-1.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	high
176752	Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2023-024)	Nessus	Amazon Linux Local Security Checks	6/6/2023	12/11/2024	high
177193	Amazon Linux 2023 : runc (ALAS2023-2023-208)	Nessus	Amazon Linux Local Security Checks	6/13/2023	12/11/2024	high
178288	Amazon Linux 2 : runc (ALASECS-2023-004)	Nessus	Amazon Linux Local Security Checks	7/14/2023	12/11/2024	high
178580	Oracle Linux 8 : buildah (ELSA-2023-12578)	Nessus	Oracle Linux Local Security Checks	7/20/2023	9/9/2025	high
178585	Oracle Linux 8 : aardvark-dns (ELSA-2023-12579)	Nessus	Oracle Linux Local Security Checks	7/20/2023	9/9/2025	high
241160	AlmaLinux 8 : container-tools:4.0 (ALSA-2023:6938)	Nessus	Alma Linux Local Security Checks	7/2/2025	7/2/2025	critical
205353	GLSA-202408-25 : runc: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	8/11/2024	8/12/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

critical

high