runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows…
Priority MEDIUM 40CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 4 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Why it matters now
EPSS 0.04409 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/opencontainers/runc (Go): 1.0.0-rc8.0.20190930145003-cad42f6e0932github.com/opencontainers/selinux (Go): 1.3.1-0.20190929122143-5215b1806f52Red Hat: 4 advisoriesRed Hat: 4 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/opencontainers/runc (Go) | before 1.0.0-rc8.0.20190930145003-cad42f6e0932 | 1.0.0-rc8.0.20190930145003-cad42f6e0932 | Patch available | GHSA-fgv8-vj5c-2ppq |
| — | github.com/opencontainers/selinux (Go) | before 1.3.1-0.20190929122143-5215b1806f52 | 1.3.1-0.20190929122143-5215b1806f52 | Patch available | GHSA-fgv8-vj5c-2ppq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/opencontainers/runc (Go) Vendor— Affected before 1.0.0-rc8.0.20190930145003-cad42f6e0932 Fixed in 1.0.0-rc8.0.20190930145003-cad42f6e0932 Patch available GHSA-fgv8-vj5c-2ppq
- github.com/opencontainers/selinux (Go) Vendor— Affected before 1.3.1-0.20190929122143-5215b1806f52 Fixed in 1.3.1-0.20190929122143-5215b1806f52 Patch available GHSA-fgv8-vj5c-2ppq
CPE configurations NVD · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* | 0.0.1 – 0.1.1 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:* | 1.0.0 rc1 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:* | 1.0.0 rc2 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:* | 1.0.0 rc3 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:* | 1.0.0 rc4 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:* | 1.0.0 rc5 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:* | 1.0.0 rc6 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:* | 1.0.0 rc7 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:* | 1.0.0 rc8 | Vulnerable | backstage |
| cpe:2.3:a:docker:docker:*:*:*:*:community:*:*:* | up to 19.03.2 | Vulnerable | Docker |
- cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions 0.0.1 – 0.1.1 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:* Versions 1.0.0 rc1 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:* Versions 1.0.0 rc2 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:* Versions 1.0.0 rc3 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:* Versions 1.0.0 rc4 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:* Versions 1.0.0 rc5 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:* Versions 1.0.0 rc6 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:* Versions 1.0.0 rc7 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:* Versions 1.0.0 rc8 Vulnerable ·backstage
- cpe:2.3:a:docker:docker:*:*:*:*:community:*:*:* Versions up to 19.03.2 Vulnerable ·Docker
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* | 4.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Red Hat |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Vulnerable | Canonical |
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
Remediation
- Fix · GHSA-fgv8-vj5c-2ppq github.com/opencontainers/runc (Go) Fixed in 1.0.0-rc8.0.20190930145003-cad42f6e0932 Advisory →
- Fix · GHSA-fgv8-vj5c-2ppq github.com/opencontainers/selinux (Go) Fixed in 1.3.1-0.20190929122143-5215b1806f52 Advisory →
Red Hat 4 advisories
- RHSA-2020:1234 Released 2020-04-01 · Red Hat rating Moderatedocker security and bug fix update
- Red Hat Enterprise Linux 7 Extras docker-2:1.13.1-161.git64e9980.el7_8, docker-client-2:1.13.1-161.git64e9980.el7_8, docker-common-2:1.13.1-161.git64e9980.el7_8 +5
- RHSA-2019:4269 Released 2019-12-17 · Red Hat rating Importantcontainer-tools:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.aarch64::container-tools:rhel8, buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.ppc64le::container-tools:rhel8, buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.s390x::container-tools:rhel8 +47
- RHSA-2019:4074 Released 2019-12-03 · Red Hat rating ModerateOpenShift Container Platform 4.2 runc security update
- Red Hat OpenShift Container Platform 4.2 runc-1.0.0-63.rc8.el8
Show 1 more Red Hat advisories
- RHSA-2019:3940 Released 2019-11-21 · Red Hat rating ModerateOpenShift Container Platform 4.1.24 runc security update
- Red Hat OpenShift Container Platform 4.1 runc-1.0.0-62.rc8.rhaos4.1.git3cbe540.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 Extras | Fixed | RHSA-2020:1234 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2019:4269 |
| Red Hat OpenShift Container Platform 4.1 | Fixed | RHSA-2019:3940 |
| Red Hat OpenShift Container Platform 4.2 | Fixed | RHSA-2019:4074 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-16884
- 2026-10-03 Alias added: GHSA-fgv8-vj5c-2ppq
References
Advisory 13
Other 14
- [debian-lts-announce] 20230218 [SECURITY] [DLA 3322-1] golang-github-opencontainers-selinux security update
- [debian-lts-announce] 20230327 [SECURITY] [DLA 3369-1] runc security update
- https://github.com/opencontainers/runc/pull/2129
- https://github.com/opencontainers/runc/pull/2130
- https://github.com/crosbymichael/runc/commit/78dce1cf1ec36bbe7fe6767bdb81f7cbf6d34d70
- https://github.com/opencontainers/runc/commit/cad42f6e0932db0ce08c3a3d9e89e6063ec283e4
- https://github.com/opencontainers/selinux/commit/03b517dc4fd57245b1cf506e8ba7b817b6d309da
- https://usn.ubuntu.com/4297-1
- https://security.netapp.com/advisory/ntap-20220221-0004
- https://pkg.go.dev/vuln/GO-2021-0085
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SPK4JWP32BUIVDJ3YODZSOEVEW6BHQCF
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DGK6IV5JGVDXHOXEKJOJWKOVNZLT6MYR
- https://lists.fedoraproject.org/archives/list/[email protected]/message/62OQ2P7K5YDZ5BRCH2Q6DHUJIHQD3QCD
- https://github.com/opencontainers/runc
Sources
- CVE-2019-16884 · CVE Program
- CVE-2019-16884 · NVD
- FIRST EPSS
- GHSA-fgv8-vj5c-2ppq · GitHub Advisory Database · CC BY 4.0
- CVE-2019-16884 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences