CVE-2023-27561

Aliases:GHSA-vpvm-3wq2-2wvmGO-2023-1627
Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 03 Mar 2023, 00:00
Last modified:16 Dec 2025, 20:02

Vulnerability Summary

Overall Risk (default)
medium
38/100
CVSS Score
7 HIGH
v3.1 (cve.org)
EPSS Score
0.15% LOW
0% probability +0.02%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

03 Mar 2023, 00:00
Published
Vulnerability first disclosed
16 Dec 2025, 20:02
Last Modified
Vulnerability information updated

Description

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

CVSS Metrics

  • v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.15%• Percentile: 35%

Techniques & Countermeasures

  • CWE-706•Use of Incorrectly-Resolved Name or Reference

    The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Affected Systems

  • debian•debian_linux

    10.0

  • github.com/opencontainers•runc

    ≥ 1.0.0-rc95, < 1.1.5

  • linuxfoundation•runc

    < 1.1.5

  • redhat•enterprise_linux

    8.0 | 9.0

  • redhat•openshift_container_platform

    4.0

References (26)