{"schema_version":"1.7.5","id":"CVE-2019-19921","published":"2020-02-12T15:15:12.210Z","modified":"2026-07-08T05:55:33.598156591Z","aliases":["GHSA-fh74-hm69-rqjw","GO-2021-0087"],"related":["ALSA-2020:1650","ALSA-2023:6380","ALSA-2023:6938","ALSA-2023:6939","CGA-9m6c-x7j6-hq56","SUSE-SU-2020:0375-1","SUSE-SU-2020:0376-1","SUSE-SU-2020:0944-1","SUSE-SU-2021:1458-1","openSUSE-SU-2020:0219-1","openSUSE-SU-2024:11358-1"],"details":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opencontainers/runc","events":[{"introduced":"0"},{"last_affected":"baf6536d6259209c3edfa2b22237af82942d3dfa"},{"introduced":"04f275d4601ca7e5ff9460cec7f65e8dd15443ec"},{"last_affected":"d736ef14f0288d6993a1845745d6756cfc9ddd5a"}],"database_specific":{"cpe":["cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"0.1.1"},{"introduced":"1.0.0-rc1"},{"last_affected":"1.0.0-rc1"},{"introduced":"1.0.0-rc2"},{"last_affected":"1.0.0-rc2"},{"introduced":"1.0.0-rc3"},{"last_affected":"1.0.0-rc3"},{"introduced":"1.0.0-rc4"},{"last_affected":"1.0.0-rc4"},{"introduced":"1.0.0-rc5"},{"last_affected":"1.0.0-rc5"},{"introduced":"1.0.0-rc6"},{"last_affected":"1.0.0-rc6"},{"introduced":"1.0.0-rc7"},{"last_affected":"1.0.0-rc7"},{"introduced":"1.0.0-rc8"},{"last_affected":"1.0.0-rc8"},{"introduced":"1.0.0-rc9"},{"last_affected":"1.0.0-rc9"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["1.0.0-rc1","1.0.0-rc2","1.0.0-rc3","1.0.0-rc4","1.0.0-rc5","1.0.0-rc6","1.0.0-rc7","1.0.0-rc8","1.0.0-rc9","v1.0.0-rc9","v1.0.0-rc2","v0.1.1","v0.1.0","v0.0.8","v0.0.7","v0.0.6","v0.0.5","v0.0.4","v0.0.2","v0.0.3","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19921.json"}}],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:0688"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:0695"},{"type":"ADVISORY","url":"https://github.com/opencontainers/runc/releases"},{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2019-19921"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202003-21"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4297-1/"},{"type":"REPORT","url":"https://github.com/opencontainers/runc/pull/2190"},{"type":"FIX","url":"https://github.com/opencontainers/runc/issues/2197"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"19.10"},{"last_affected":"19.10"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux"},{"cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"},{"introduced":"10.0"},{"last_affected":"10.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.1"},{"last_affected":"15.1"}],"source":"CPE_STRING","vendor_product":"opensuse:leap"},{"cpes":["cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.1"},{"last_affected":"4.1"},{"introduced":"4.2"},{"last_affected":"4.2"}],"source":"CPE_STRING","vendor_product":"redhat:openshift_container_platform"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}