{"id":"CVE-2023-27561","published":"2023-03-03T00:00:00Z","modified":"2025-12-16T20:02:09Z","title":"runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to…","vendor":null,"product":null,"tier":"tail","description":{"text":"runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.","provenance":"source","from":"CVE.org"},"cvss":{"score":7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00448,"percentile":0.38878,"provenance":"source"},"cwes":[{"id":"CWE-706","name":"Use of Incorrectly-Resolved Name or Reference"}],"references":[{"url":"https://github.com/opencontainers/runc/issues/3751","tags":[]},{"url":"https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334","tags":[]},{"url":"https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/","tags":["vendor-advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241206-0004/","tags":[]}],"priority":{"score":12.7,"factors":[{"name":"EPSS percentile","points":7.78},{"name":"CVSS severity","points":4.9}]},"affected":[{"ecosystem":"Go","package":"github.com/opencontainers/runc","vulnerableRanges":[">=1.0.0-rc95, <1.1.5"],"patched":["1.1.5"],"from":["GHSA-vpvm-3wq2-2wvm","GO-2023-1627"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1117","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencontainers-runc-cve-2016-9962","parents":[{"from":"CVE-2019-19921","to":"CVE-2023-27561","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"NOTE: this issue exists because of a CVE-2019-19921 regression.","from":"CVE.org","in":"CVE-2023-27561"},{"kind":"similar","provenance":"machine","score":0.82,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2021-43784","published":"2021-12-06","fixed":"1.1.0","kev":false},{"cve":"CVE-2022-29162","published":"2022-05-17","fixed":"1.1.2","kev":false,"link":{"from":"CVE-2022-29162","to":"CVE-2023-27561","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.1.2","toFixed":"1.1.5","daysApart":290}]}},{"cve":"CVE-2023-25809","published":"2023-03-29","fixed":"1.1.5","kev":false},{"cve":"CVE-2023-27561","published":"2023-03-03","fixed":"1.1.5","kev":false},{"cve":"CVE-2023-28642","published":"2023-03-29","fixed":"1.1.5","kev":false},{"cve":"CVE-2024-21626","published":"2024-01-31","fixed":"1.1.12","kev":false},{"cve":"CVE-2024-45310","published":"2024-09-03","fixed":"1.2.0-rc.3","kev":false}],"package":"Go:github.com/opencontainers/runc"}}