Skip to main content

Use of Incorrectly-Resolved Name or Reference

CVE-2023-27561

High
7/10

Summary

runc 1.0.0 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to "libcontainer/rootfs_linux.go". To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression. This issue has same fix as CVE-2023-28642.

  • HIGH
  • LOCAL
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-706 - Use of Incorrectly-Resolved Name or Reference

The software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

References

Advisory Timeline

  • Published