runc through 1.0-rc6, as used in Docker before 18.09.2...
High severity
Unreviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Feb 11, 2024
Description
Published by the National Vulnerability Database
Feb 11, 2019
Published to the GitHub Advisory Database
May 13, 2022
Last updated
Feb 11, 2024
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
References