Red Hat OpenShift: CVE-2023-27561: runc: volume mount race condition (regression of )

Red Hat OpenShift: CVE-2023-27561: runc: volume mount race condition (regression of )

Severity

7

CVSS

(AV:L/AC:M/Au:S/C:C/I:C/A:C)

Published

03/03/2023

Created

06/27/2023

Added

06/26/2023

Modified

01/28/2025

Description

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

Solution(s)

• linuxrpm-upgrade-runc

References

• https://attackerkb.com/topics/cve-2023-27561
• CVE - 2023-27561
• RHSA-2023:1326
• RHSA-2023:3612
• RHSA-2023:5006
• RHSA-2023:6380
• RHSA-2023:6938
• RHSA-2023:6939

View more