RHSA-2023:6380MediumCVSS 7.8

Red Hat Security Advisory: runc security update

Published
November 7, 2023
Last Modified
August 16, 2026

🔗 CVE IDs covered (5)

CVE-2023-27561 →CVE-2023-28642 →CVE-2021-43784 →CVE-2022-41724 →CVE-2023-25809 →

📋 Description

CVE-2021-43784 — runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration CVE-2022-41724 — golang: crypto/tls: large handshake records may cause panics CVE-2023-25809 — runc: Rootless runc makes /sys/fs/cgroup writable CVE-2023-27561 — runc: volume mount race condition (regression of CVE-2019-19921) CVE-2023-28642 — runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream (v. 9)
  • runc-4:1.1.9-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-4:1.1.9-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-4:1.1.9-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-4:1.1.9-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-4:1.1.9-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-debuginfo-4:1.1.9-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-debuginfo-4:1.1.9-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-debuginfo-4:1.1.9-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-debuginfo-4:1.1.9-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-debugsource-4:1.1.9-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-debugsource-4:1.1.9-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-debugsource-4:1.1.9-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • runc-debugsource-4:1.1.9-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Condition 1: Unshare the cgroup namespace ((docker|podman|nerdctl) run --cgroupns=private). This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. Condition 2 (very rare): add /sys/fs/cgroup to maskedPaths Workaround: Avoid using an untrusted container image.

🔗 References (9)