Skip to content
Fencer Vulns
high 7.0

CVE-2019-19921 json

opencontainers runc contains procfs race condition with a shared volume mount

published 2020-02-12 6 y ago modified 2026-09-10 1 mo ago also GHSA-fh74-hm69-rqjw , GO-2021-0087 , EUVD-2021-1060

cvss
7.0
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)

Patch / fix

  • go github.com/opencontainers/runc 1.0.0-rc9.0.20200122160610-2fc03cc11c77
  • runc Debian 14, Debian 13, Debian 12 1.0.0~rc10+dfsg1-1

debian advisories DEBIAN-CVE-2019-19921

  • runc Ubuntu 18.04 LTS 1.0.0~rc10-0ubuntu1~18.04.2
  • runc Ubuntu 20.04 LTS 1.0.0~rc10-0ubuntu1
  • runc Ubuntu Pro 16.04 LTS 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4

ubuntu advisories UBUNTU-CVE-2019-19921

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.12-9.module+el8.2.0+5029+3ac48e7d
  • criu RHEL 8 3.12-9.module+el8.2.0+5029+3ac48e7d
  • runc RHEL 8 1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb
  • udica RHEL 8 0.2.1-2.module+el8.2.0+4896+8f613c81
  • conmon RHEL 8 2:2.0.6-1.module+el8.2.0+5182+3136e5d4
  • podman RHEL 8 1.6.4-10.module+el8.2.0+6063+e761893a
  • skopeo RHEL 8 1:0.1.40-10.module+el8.2.0+5955+6cd70ceb
  • buildah RHEL 8 1.11.6-7.module+el8.2.0+5856+b8046c6d

red hat advisories RHSA-2020:1650RHSA-2020:1485RHSA-2020:0695RHSA-2020:0688RHSA-2020:0942

  • runc SLE Module for Containers 12 1.0.0~rc93-16.8.1
  • docker SLE Module for Containers 12 20.10.6_ce-98.66.1
  • containerd SLE Module for Containers 12 1.4.4-16.38.1
  • runc SLE Module for Containers 15 SP1 1.0.0~rc10-1.9.1
  • docker-runc SLE Module for Containers 12 1.0.0rc8+gitr3917_3e425f80a8c9-1.40.1
  • docker-runc SLE Module for Containers 15 SP1 1.0.0rc8+gitr3917_3e425f80a8c9-6.32.1

suse advisories SUSE-SU-2021:1458-1SUSE-SU-2020:0944-1SUSE-SU-2020:0376-1SUSE-SU-2020:0375-1

  • runc openSUSE Tumbleweed 1.0.2-1.2
  • docker-runc openSUSE Leap 15.1 1.0.0rc8+gitr3917_3e425f80a8c9-lp151.3.15.1

opensuse advisories openSUSE-SU-2024:11358-1openSUSE-SU-2020:0219-1

  • crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crun AlmaLinux 8 1.8.3-1.module_el8.9.0+3627+db8ec155
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
  • udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155
  • conmon AlmaLinux 8 2:2.1.4-2.module_el8.9.0+3627+db8ec155

almalinux advisories ALSA-2023:6938ALSA-2023:6939ALSA-2023:6380ALSA-2020:1650

  • criu Rocky Linux 8 3.12-9.module+el8.5.0+681+c9a1951f
  • criu Rocky Linux 8 3.12-9.module+el8.4.0+557+48ba8b2f
  • runc Rocky Linux 8 1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2
  • udica Rocky Linux 8 0.2.1-2.module+el8.5.0+770+e2f49861
  • udica Rocky Linux 8 0.2.1-2.module+el8.4.0+559+c02fa3b2
  • udica Rocky Linux 8 0.2.1-2.module+el8.5.0+708+6758137d
  • toolbox Rocky Linux 8 0.0.7-1.module+el8.5.0+770+e2f49861
  • toolbox Rocky Linux 8 0.0.7-1.module+el8.4.0+559+c02fa3b2

rocky linux advisories RLSA-2020:1650

  • runc Alpine 3.11 1.0.0_rc10
  • runc Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 1.0.0_rc10-r0
  • containerd Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 1.3.3-r0

alpine advisories ALPINE-CVE-2019-19921

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-19921 updated cvss 7.0

runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation

  • Red Hat Enterprise Linux 8 runc
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.2 osp-director-provisioner-container, rhosp-rhel8-tech-preview/osp-director-operator, rhosp-rhel8-tech-preview/osp-director-downloader
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 Extras runc 1.0.0-66.rc8.el7_7
    fixed: vendor fix RHSA-2020:0942
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.12-9.module+el8.2.0+5029+3ac48e7d, criu 3.12-9.module+el8.2.0+5029+3ac48e7d, udica 0.2.1-2.module+el8.2.0+4896+8f613c81, conmon 2.0.6-1.module+el8.2.0+5182+3136e5d4, podman 1.6.4-10.module+el8.2.0+6063+e761893a, toolbox 0.0.7-1.module+el8.2.0+6096+9c3f08f3, +16 more
    fixed: vendor fix RHSA-2020:1650
  • Red Hat OpenShift Container Platform 4.1 runc 1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0
    fixed: vendor fix RHSA-2020:0695
  • Red Hat OpenShift Container Platform 4.2 runc 1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8
    fixed: vendor fix RHSA-2020:0688
  • Red Hat OpenShift Container Platform 4.3 runc 1.0.0-66.rc10.rhaos4.3.el7_8
    fixed: vendor fix RHSA-2020:1485
  • Red Hat OpenShift Container Platform 4.4 openshift4/ose-cli v4.4.0-202004261927, openshift4/ose-pod v4.4.0-202004261927, openshift4/ose-etcd v4.4.0-202004261927, openshift4/ose-tests v4.4.0-202004261927, openshift4/ose-console v4.4.0-202004261927, openshift4/ose-coredns v4.4.0-202004261927, +76 more
    fixed: vendor fix RHBA-2020:0581
show 1 more
  • Red Hat Enterprise Linux 7 docker Red Hat Enterprise Linux 8 runc
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:U

Affected packages

ecosystem package affected fixed in
go github.com/opencontainers/runc
<1.0.0-rc9.0.20200122160610-2fc03cc11c77
1.0.0-rc9.0.20200122160610-2fc03cc11c77

Classification

Weakness
  • CWE-706 Use of Incorrectly-Resolved Name or Reference
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.