USN-4297-1: runC vulnerabilities
9 March 2020
Several security issues were fixed in runc.
Releases
Packages
- runc - Open Container Project
Details
It was discovered that runC incorrectly checked mount targets. An attacker
with a malicious container image could possibly mount over the /proc
directory and escalate privileges. This issue only affected Ubuntu 18.04
LTS. (CVE-2019-16884)
It was discovered that runC incorrectly performed access control. An
attacker could possibly use this issue to escalate privileges.
(CVE-2019-19921)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 19.10
Ubuntu 18.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-4867-1: runc, golang-github-opencontainers-runc-dev
- USN-6088-2: runc, golang-github-opencontainers-runc-dev