Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

runc Privilege Escalation Vulnerability

Details of a privilege escalation vulnerability in the runc open-source container runtime have been disclosed by its maintainers. They claim a local threat actor could exploit this vulnerability to obtain administrative privileges within an affected container.

Threat ID:
CC-2927
Category:
Threat Severity:
Low
Threat Vector:
Published:
13 February 2019 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Details of a privilege escalation vulnerability in the runc open-source container runtime have been disclosed by its maintainers. They claim a local threat actor could exploit this vulnerability to obtain administrative privileges within an affected container.

Affected platforms

The following platforms are known to be affected:

Linux

Linux-based container systems using runc, including Kubernetes, Docker and Apache Mesos

Threat details

Update  

A Go-based proof-of-concept exploit for CVE-2019-5736 has been made publicly available, raising the possibility of this vulnerability being exploited in the wild.

For further information:

Remediation steps

Type Step

Users and administrators are encouraged to review the runc  

 

Last edited: 14 February 2020 2:51 pm