{"id":"CVE-2021-43784","aliases":["ALPINE-CVE-2021-43784","ALSA-2023:6380","AZL-6682","BELL-CVE-2021-43784","DEBIAN-CVE-2021-43784","DLA-2841-1","DLA-3735-1","EUVD-2021-2591","GHSA-v95c-p5hm-xq8f","GO-2022-0274","MGASA-2021-0553","RHSA-2023:6380","SUSE-SU-2021:4059-1","SUSE-SU-2021:4171-1","UBUNTU-CVE-2021-43784","USN-6088-2","openSUSE-SU-2021:1625-1","openSUSE-SU-2021:4171-1","openSUSE-SU-2024:11664-1"],"status":"published","title":"Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration","description":"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.","severity":{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01803,"percentile":0.78821,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2021-12-06T00:00:00Z","modified":"2026-11-03T06:31:48Z","fixes":[{"ecosystem":"Go","package":"github.com/opencontainers/runc","fixed_in":["1.0.3","1.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.15","package":"runc","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"runc","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"runc","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"runc","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"runc","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"runc","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"runc","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"runc","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"runc","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"runc","fixed_in":["1.0.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-runc","fixed_in":["1.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"runc","fixed_in":["1.0.3+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"runc","fixed_in":["1.0.3+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"runc","fixed_in":["1.0.3+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"runc","fixed_in":["0.1.1+dfsg1-2+deb9u3"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"opencontainers-runc","fixed_in":["1.0.3-1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"runc","fixed_in":["1.0.3-16.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP2","package":"runc","fixed_in":["1.0.3-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"runc","fixed_in":["1.0.3-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"runc","fixed_in":["1.0.3-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"runc","fixed_in":["1.0.3-27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"runc","fixed_in":["1.0.3-27.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"runc","fixed_in":["1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"runc","fixed_in":["1.0.3-lp152.2.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"runc","fixed_in":["1.0.3-27.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"runc","fixed_in":["1.0.3-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/opencontainers/runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.9-1.el9"}]}],"bundled":6},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1+dfsg1-2+deb9u3"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc6+dfsg1-3+deb10u3"}]}],"versions":["1.0.0~rc6+dfsg1-3","1.0.0~rc6+dfsg1-3+deb10u1","1.0.0~rc6+dfsg1-3+deb10u2"],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/opencontainers/runc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/opencontainers/runc","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.1-0.20211012131345-9c444070ec7b"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"opencontainers-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.9-1.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.9-1.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.9-1.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-16.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP2","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-27.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4"}]}],"versions":["0.0.8+dfsg-2","0.1.1-0ubuntu5~16.04","1.0.0~rc1-0ubuntu1~16.04","1.0.0~rc1-0ubuntu2~16.04.1","1.0.0~rc1-0ubuntu2~16.04.1.1","1.0.0~rc2-0ubuntu2~16.04.1","1.0.0~rc2+docker1.12.6-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.2","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.3","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm1","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0~rc2+docker1.13.1-0ubuntu1","1.0.0~rc4+dfsg1-2","1.0.0~rc4+dfsg1-6","1.0.0~rc4+dfsg1-6ubuntu0.18.04.1","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.1","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.2","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.2+esm1","1.0.0~rc10-0ubuntu1~18.04.1","1.0.0~rc10-0ubuntu1~18.04.2","1.0.0~rc93-0ubuntu1~18.04.1","1.0.0~rc93-0ubuntu1~18.04.2","1.0.0~rc95-0ubuntu1~18.04.1","1.0.0~rc95-0ubuntu1~18.04.2","1.0.1-0ubuntu2~18.04.1","1.1.0-0ubuntu1~18.04.1","1.1.4-0ubuntu1~18.04.1","1.1.4-0ubuntu1~18.04.2","1.1.4-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4"}]}],"versions":["0.0.8+dfsg-2","0.1.1-0ubuntu5~16.04","1.0.0~rc1-0ubuntu1~16.04","1.0.0~rc1-0ubuntu2~16.04.1","1.0.0~rc1-0ubuntu2~16.04.1.1","1.0.0~rc2-0ubuntu2~16.04.1","1.0.0~rc2+docker1.12.6-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.2","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.3","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm1","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-lp152.2.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-27.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"linuxfoundation","product":"runc"},{"vendor":"opencontainers","product":"runc"}],"references":[{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-v95c-p5hm-xq8f","tags":["x_transferred","Patch","Third Party Advisory","fix","web","article","report"]},{"url":"https://github.com/opencontainers/runc/commit/9c444070ec7bb83995dbc0185da68284da71c554","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/opencontainers/runc/commit/d72d057ba794164c3cce9451a00b72a78b25e1ae","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/opencontainers/runc/commit/f50369af4b571e358f20b139eea52d612eb55eed","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=2241","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00005.html","tags":["mailing-list","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/02/msg00005.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43784","tags":["web","advisory"]},{"url":"https://github.com/opencontainers/runc/commit/dde509df4e28cec33b3c99c6cda3d4fd5beafc77","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0274","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v95c-p5hm-xq8f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-43784","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6380","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-43784","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41724","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25809","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27561","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28642","tags":["report"]},{"url":"https://bugzilla.redhat.com/2029439","tags":["report"]},{"url":"https://bugzilla.redhat.com/2175721","tags":["report"]},{"url":"https://bugzilla.redhat.com/2178492","tags":["report"]},{"url":"https://bugzilla.redhat.com/2182883","tags":["report"]},{"url":"https://bugzilla.redhat.com/2182884","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6380.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-43784","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-43784","tags":["advisory"]},{"url":"https://github.com/opencontainers/runc","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0553.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29738","tags":["report"]},{"url":"https://www.debian.org/lts/security/2021/dla-2841","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182883","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182884","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6380.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43784","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41724","tags":["advisory"]},{"url":"https://go.dev/cl/468125","tags":["article"]},{"url":"https://go.dev/issue/58001","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1570","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25809","tags":["advisory"]},{"url":"https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17","tags":["article"]},{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27561","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27561","tags":["advisory"]},{"url":"https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9","tags":["article"]},{"url":"https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334","tags":["article"]},{"url":"https://github.com/opencontainers/runc/issues/3751","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28642","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g2j6-57v7-gm8c","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214059-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193436","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43784","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214171-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-43784","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/12/06/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6088-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-19921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-28642","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCIUJE3F5UEWI5TYYL5CQ7SCQZU5V76Q/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6DD7LA7CG2OYZJT2SOA3MHVO7GOW3ANO/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-43784","title":"Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration","description":"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.","status":"published","published":"2021-12-06T00:00:00Z","modified":"2024-10-15T17:14:20.24Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:32:56.689433Z"}],"euvd":[{"id":"EUVD-2021-2591","description":"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.","status":"published","published":"2021-12-06T00:00:00Z","modified":"2024-10-15T17:14:20Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:27:36.689661Z"}],"ghsa":[{"id":"GHSA-v95c-p5hm-xq8f","title":"Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in RunC","description":"### Impact\n\nIn runc, [netlink](https://www.man7.org/linux/man-pages/man7/netlink.7.html) is used internally as a serialization system for specifying the relevant container configuration to the C portion of our code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration.\n\nThis vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces.\n\nPrior to 9c444070ec7bb83995dbc0185da68284da71c554, in practice it was fairly difficult to specify an arbitrary-length netlink message with most container runtimes. The only user-controlled byte array was the namespace paths attributes which can be specified in runc's `config.json`, but as far as we can tell no container runtime gives raw access to that configuration setting -- and having raw access to that setting **would allow the attacker to disable namespace protections entirely anyway** (setting them to `/proc/1/ns/...` for instance). In addition, each namespace path is limited to 4096 bytes (with only 7 namespaces supported by runc at the moment) meaning that even with custom namespace paths it appears an attacker still cannot shove enough bytes into the netlink bytemsg in order to overflow the uint16 counter.\n\nHowever, out of an abundance of caution (given how old this bug is) we decided to treat it as a potentially exploitable vulnerability with a low severity. After 9c444070ec7bb83995dbc0185da68284da71c554 (which was not present in any release of runc prior to the discovery of this bug), all mount paths are included as a giant netlink message which means that this bug becomes significantly more exploitable in more reasonable threat scenarios.\n\nThe main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure), though as mentioned above it appears this bug was not practically exploitable on any released version of runc to date.\n\n### Patches\nThe patch for this is d72d057ba794164c3cce9451a00b72a78b25e1ae and runc 1.0.3 was released with this bug fixed.\n\n### Workarounds\nTo the extent this is exploitable, disallowing untrusted namespace paths in container configuration should eliminate all practical ways of exploiting this bug. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.\n\n### References\n* commit d72d057ba794 (\"runc init: avoid netlink message length overflows\")\n* https://bugs.chromium.org/p/project-zero/issues/detail?id=2241\n\n### Credits\nThanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability. In particular, the fact they found this vulnerability so quickly, before we made a 1.1 release of runc (which would've been vulnerable) was quite impressive.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [our repo](https://github.com/opencontainers/runc)\n","status":"published","published":"2021-12-07T21:22:39Z","modified":"2024-02-27T05:06:33Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:37:38.935144Z"}],"nvd":[{"id":"CVE-2021-43784","description":"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.","status":"published","published":"2021-12-06T18:15:08.24Z","modified":"2026-06-17T04:11:25.983Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:07:01.811115Z"}],"osv":[{"id":"ALPINE-CVE-2021-43784","description":"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.","status":"published","published":"2021-12-06T18:15:08.24Z","modified":"2026-11-03T06:31:48.549932019Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"AZL-6682","title":"CVE-2021-43784 affecting package moby-runc for versions less than 1.1.0-1","description":"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.","status":"published","published":"2021-12-06T18:15:08Z","modified":"2026-04-21T04:37:59.11371Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"BELL-CVE-2021-43784","title":"CVE-2021-43784 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:41.465429Z","modified":"2026-01-26T10:04:56.135152Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-43784","description":"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.","status":"published","published":"2021-12-06T18:15:08.24Z","modified":"2026-10-20T14:34:28.596701069Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-43784","description":"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.","status":"published","published":"2021-12-06T18:15:08.24Z","modified":"2026-10-23T18:04:16.529872704Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"GHSA-v95c-p5hm-xq8f","title":"Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in RunC","description":"### Impact\n\nIn runc, [netlink](https://www.man7.org/linux/man-pages/man7/netlink.7.html) is used internally as a serialization system for specifying the relevant container configuration to the C portion of our code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration.\n\nThis vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces.\n\nPrior to 9c444070ec7bb83995dbc0185da68284da71c554, in practice it was fairly difficult to specify an arbitrary-length netlink message with most container runtimes. The only user-controlled byte array was the namespace paths attributes which can be specified in runc's `config.json`, but as far as we can tell no container runtime gives raw access to that configuration setting -- and having raw access to that setting **would allow the attacker to disable namespace protections entirely anyway** (setting them to `/proc/1/ns/...` for instance). In addition, each namespace path is limited to 4096 bytes (with only 7 namespaces supported by runc at the moment) meaning that even with custom namespace paths it appears an attacker still cannot shove enough bytes into the netlink bytemsg in order to overflow the uint16 counter.\n\nHowever, out of an abundance of caution (given how old this bug is) we decided to treat it as a potentially exploitable vulnerability with a low severity. After 9c444070ec7bb83995dbc0185da68284da71c554 (which was not present in any release of runc prior to the discovery of this bug), all mount paths are included as a giant netlink message which means that this bug becomes significantly more exploitable in more reasonable threat scenarios.\n\nThe main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure), though as mentioned above it appears this bug was not practically exploitable on any released version of runc to date.\n\n### Patches\nThe patch for this is d72d057ba794164c3cce9451a00b72a78b25e1ae and runc 1.0.3 was released with this bug fixed.\n\n### Workarounds\nTo the extent this is exploitable, disallowing untrusted namespace paths in container configuration should eliminate all practical ways of exploiting this bug. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.\n\n### References\n* commit d72d057ba794 (\"runc init: avoid netlink message length overflows\")\n* https://bugs.chromium.org/p/project-zero/issues/detail?id=2241\n\n### Credits\nThanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability. In particular, the fact they found this vulnerability so quickly, before we made a 1.1 release of runc (which would've been vulnerable) was quite impressive.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [our repo](https://github.com/opencontainers/runc)\n","status":"published","published":"2021-12-07T21:22:39Z","modified":"2026-09-10T03:49:10.478071172Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"RHSA-2023:6380","title":"Red Hat Security Advisory: runc security update","status":"published","published":"2024-09-30T14:58:06Z","modified":"2026-10-16T10:02:57Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2021-43784","description":"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.","status":"published","published":"2021-12-06T18:15:00Z","modified":"2026-02-04T03:03:44.980561Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"ALSA-2023:6380","title":"Moderate: runc security update","description":"The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.\n\nSecurity Fix(es):\n\n* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)\n* runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)\n* runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)\n* runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration (CVE-2023-28642)\n* runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (CVE-2021-43784)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:32.183912903Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"DLA-2841-1","title":"runc - security update","status":"published","published":"2021-12-06T00:00:00Z","modified":"2026-03-09T01:23:05.085654Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3735-1","title":"runc - security update","status":"published","published":"2024-02-19T00:00:00Z","modified":"2026-03-09T01:20:12.789116Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"GO-2022-0274","title":"Namespace restriction bypass in github.com/opencontainers/runc","description":"An attacker with partial control over the bind mount sources of a new container can bypass namespace restrictions.","status":"published","published":"2022-07-15T23:08:20Z","modified":"2026-02-04T02:26:28.34324Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2021-0553","title":"Updated opencontainers-runc packages fix security vulnerability","description":"It was discovered that there was an overflow issue in runc, the runtime\nfor the Open Container Project, often used with Docker. The Netlink\n'bytemsg' length field could have allowed an attacker to override\nNetlink-based container configurations. This vulnerability required the\nattacker to have some control over the configuration of the container, but\nwould have allowed the attacker to bypass the namespace restrictions of\nthe container by simply adding their own Netlink payload which disables\nall namespaces. (CVE-2021-43784)\n","status":"published","published":"2021-12-10T22:19:07Z","modified":"2026-04-16T04:43:21.990877297Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1625-1","title":"Security update for runc","description":"This update for runc fixes the following issues:\n\nUpdate to runc v1.0.3. \n    \n* CVE-2021-43784: Fixed a potential vulnerability related to the internal usage\n  of netlink, which is believed to not be exploitable with any released versions of runc (bsc#1193436)\n* Fixed inability to start a container with read-write bind mount of a read-only fuse host mount.\n* Fixed inability to start when read-only /dev in set in spec.\n* Fixed not removing sub-cgroups upon container delete, when rootless cgroup\n  v2 is used with older systemd.\n* Fixed returning error from GetStats when hugetlb is unsupported (which\n  causes excessive logging for kubernetes).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-12-26T13:06:17Z","modified":"2026-02-04T02:35:08.312315Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:4171-1","title":"Security update for runc","description":"This update for runc fixes the following issues:\n\nUpdate to runc v1.0.3. \n    \n* CVE-2021-43784: Fixed a potential vulnerability related to the internal usage\n  of netlink, which is believed to not be exploitable with any released versions of runc (bsc#1193436)\n* Fixed inability to start a container with read-write bind mount of a read-only fuse host mount.\n* Fixed inability to start when read-only /dev in set in spec.\n* Fixed not removing sub-cgroups upon container delete, when rootless cgroup\n  v2 is used with older systemd.\n* Fixed returning error from GetStats when hugetlb is unsupported (which\n  causes excessive logging for kubernetes).\n","status":"published","published":"2021-12-23T08:55:34Z","modified":"2026-02-04T03:59:16.512267Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11664-1","title":"runc-1.0.3-1.1 on GA media","description":"These are all security issues fixed in the runc-1.0.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:08:18.318133Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:4059-1","title":"Security update for runc","description":"This update for runc fixes the following issues:\n\nUpdate to runc v1.0.3. \n    \n* CVE-2021-43784: Fixed a potential vulnerability related to the internal usage\n  of netlink, which is believed to not be exploitable with any released versions of runc (bsc#1193436)\n* Fixed inability to start a container with read-write bind mount of a read-only fuse host mount.\n* Fixed inability to start when read-only /dev in set in spec.\n* Fixed not removing sub-cgroups upon container delete, when rootless cgroup\n  v2 is used with older systemd.\n* Fixed returning error from GetStats when hugetlb is unsupported (which\n  causes excessive logging for kubernetes).\n","status":"published","published":"2021-12-14T11:47:19Z","modified":"2026-02-04T03:29:42.925497Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2021:4171-1","title":"Security update for runc","description":"This update for runc fixes the following issues:\n\nUpdate to runc v1.0.3. \n    \n* CVE-2021-43784: Fixed a potential vulnerability related to the internal usage\n  of netlink, which is believed to not be exploitable with any released versions of runc (bsc#1193436)\n* Fixed inability to start a container with read-write bind mount of a read-only fuse host mount.\n* Fixed inability to start when read-only /dev in set in spec.\n* Fixed not removing sub-cgroups upon container delete, when rootless cgroup\n  v2 is used with older systemd.\n* Fixed returning error from GetStats when hugetlb is unsupported (which\n  causes excessive logging for kubernetes).\n","status":"published","published":"2021-12-23T08:55:23Z","modified":"2026-02-04T04:33:42.558259Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-6088-2","title":"runc vulnerabilities","description":"USN-6088-1 fixed vulnerabilities in runC. This update provides\nthe corresponding updates for Ubuntu 16.04 LTS.\n\nIt was discovered that runC incorrectly performed access control when\nmounting /proc to non-directories. An attacker could possibly use\nthis issue to escalate privileges.\n(CVE-2019-19921)\n\nFelix Wilhelm discovered that runC incorrecly handled netlink \nmessages. An attacker could possibly use\nthis issue to escalate privileges. (CVE-2021-43784)\n\nAndrew G. Morgan discovered that runC incorrectly set\ninherited process capabilities inside the container.\nAn attacker could possibly use this issue to\nescalate privileges. (CVE-2022-29162)\n\nOriginal advisory details:\n\n It was discovered that runC incorrectly made /sys/fs/cgroup\n writable when in rootless mode. An attacker could possibly\n use this issue to escalate privileges. (CVE-2023-25809)\n \n It was discovered that runC incorrectly performed access control when\n mounting /proc to non-directories. An attacker could possibly use\n this issue to escalate privileges. (CVE-2023-27561)\n \n It was discovered that runC incorrectly handled /proc and \n /sys mounts inside a container. An attacker could possibly\n use this issue to bypass AppArmor, and potentially SELinux.\n (CVE-2023-28642)\n","status":"published","published":"2023-05-23T14:07:29Z","modified":"2026-06-25T13:32:04.23949437Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}