CVE-2023-27561

Aliases:GHSA-vpvm-3wq2-2wvmGO-2023-1627DEBIAN-CVE-2023-27561CGA-2r35-qj4w-qhv2CGA-hjfw-fjj7-rg6wCGA-pcrr-jqgj-q9g9CGA-q4c9-fh7x-w566CGA-qx8v-j27q-5jfvCGA-vmfj-8wf5-85vvCGA-vp7x-r96j-f4h3CGA-wmwf-cfv8-xrxp
Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 03 Mar 2023, 00:00
Last modified:16 Dec 2025, 20:02

Vulnerability Summary

Overall Risk (default)
medium
38/100
CVSS Score
7 HIGH
v3.1 (cve.org)
EPSS Score
0.45% LOW
0% probability +0.32%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

03 Mar 2023, 00:00
Published
Vulnerability first disclosed
16 Dec 2025, 20:02
Last Modified
Vulnerability information updated

Description

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

CVSS Metrics

  • v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.45%• Percentile: 38%

Techniques & Countermeasures

  • CWE-706•Use of Incorrectly-Resolved Name or Reference

    The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Affected Systems

  • chainguard•cadvisor

    < 0

  • chainguard•ctop

    < 0.7.7-r13

  • chainguard•podman

    < 5.2.2-r1

  • chainguard•podman-doc

    < 5.2.2-r1

  • wolfi•cadvisor

    < 0

  • wolfi•ctop

    < 0.7.7-r13

  • wolfi•podman

    < 5.2.2-r1

  • wolfi•podman-doc

    < 5.2.2-r1

  • debian•runc

    < 1.0.0~rc93+ds1-5+deb11u5 | < 1.1.5+ds1-1 | < 1.1.5+ds1-1 | < 1.1.5+ds1-1

  • debian•debian_linux

    10.0

  • github.com/opencontainers•runc

    ≥ 1.0.0-rc95, < 1.1.5

  • linuxfoundation•runc

    < 1.1.5

  • redhat•enterprise_linux

    8.0 | 9.0

  • redhat•openshift_container_platform

    4.0

References (28)