CVE-2019-19921
📋 TL;DR
CVE-2019-19921 is a privilege escalation vulnerability in runc (container runtime) that allows attackers with container creation privileges to escape container isolation and gain root access on the host system. It affects runc versions up to 1.0.0-rc9 when using custom volume mounts. Docker is not affected due to implementation differences.
💻 Affected Systems
- runc
- Kubernetes (when using vulnerable runc)
- containerd (when using vulnerable runc)
- CRI-O (when using vulnerable runc)
📦 What is this software?
Leap by Opensuse
Runc by Linuxfoundation
Runc by Linuxfoundation
Runc by Linuxfoundation
Runc by Linuxfoundation
Runc by Linuxfoundation
Runc by Linuxfoundation
Runc by Linuxfoundation
Runc by Linuxfoundation
Runc by Linuxfoundation
Runc by Linuxfoundation
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Full host compromise with root privileges, allowing complete control over the host system and all containers running on it.
Likely Case
Container escape leading to unauthorized access to host filesystem, sensitive data exposure, and potential lateral movement to other containers.
If Mitigated
Limited impact with proper container isolation, minimal container privileges, and restricted volume mount configurations.
🎯 Exploit Status
Exploit requires ability to spawn two containers with custom volume-mount configurations and run custom images. Attack requires container creation privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: runc 1.0.0-rc10 and later
Vendor Advisory: https://access.redhat.com/errata/RHSA-2020:0688
Restart Required: Yes
Instructions:
1. Update runc to version 1.0.0-rc10 or later. 2. Update container runtime (containerd, CRI-O) to versions that include patched runc. 3. Restart all containers and container runtime services. 4. For Kubernetes, update kubelet and container runtime components.
🔧 Temporary Workarounds
Restrict container privileges
linuxImplement least privilege principles for containers to limit attack surface
Use Pod Security Policies (Kubernetes)
Implement seccomp profiles
Drop unnecessary capabilities
Use read-only root filesystems
Limit volume mount capabilities
linuxRestrict ability to mount arbitrary host paths in containers
Use Kubernetes admission controllers to validate volume mounts
Implement container runtime policies
🧯 If You Can't Patch
- Implement strict container privilege restrictions using security contexts
- Monitor for suspicious container creation patterns and volume mount attempts
🔍 How to Verify
Check if Vulnerable:
Check runc version: runc --version | grep version. If version is 1.0.0-rc9 or earlier, system is vulnerable.Check Version:
runc --versionVerify Fix Applied:
Verify runc version is 1.0.0-rc10 or later: runc --version | grep version📡 Detection & Monitoring
Log Indicators:
- Unusual container creation patterns
- Multiple containers with custom volume mounts created by same user
- Container escape attempts in audit logs
Network Indicators:
- Unexpected outbound connections from container hosts
- Lateral movement attempts between containers
SIEM Query:
container.runtime=runc AND container.version<=1.0.0-rc9 AND event.action=create AND volume.mount.type=custom🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html
- https://access.redhat.com/errata/RHSA-2020:0688
- https://access.redhat.com/errata/RHSA-2020:0695
- https://github.com/opencontainers/runc/issues/2197
- https://github.com/opencontainers/runc/pull/2190
- https://github.com/opencontainers/runc/releases
- https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/
- https://security-tracker.debian.org/tracker/CVE-2019-19921
- https://security.gentoo.org/glsa/202003-21
- https://usn.ubuntu.com/4297-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html
- https://access.redhat.com/errata/RHSA-2020:0688
- https://access.redhat.com/errata/RHSA-2020:0695
- https://github.com/opencontainers/runc/issues/2197
- https://github.com/opencontainers/runc/pull/2190
- https://github.com/opencontainers/runc/releases
- https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/
- https://security-tracker.debian.org/tracker/CVE-2019-19921
- https://security.gentoo.org/glsa/202003-21
- https://usn.ubuntu.com/4297-1/
