The remote host is affected by the vulnerability described in GLSA-202003-21 (runC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in runC. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker, by running a malicious Docker image, could escape the       container, bypass security restrictions, escalate privileges or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update of the telegraf package has been released.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0110 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-5736:
    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2019-14378:
    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment.

    CVE-2019-16884:
    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory.

    CVE-2019-19921:
    runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.)

    CVE-2020-1983:
    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service.

    CVE-2020-7039:
    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code.

    CVE-2020-8608:
    In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code.

    CVE-2020-10756:
    An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1.

    CVE-2021-3595:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-20188:
    A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0110 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-5736:
    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the abilityto execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2019-14378:
    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment.

    CVE-2019-16884:
    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory.

    CVE-2019-19921:
    runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.)

    CVE-2020-1983:
    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service.

    CVE-2020-7039:
    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code.

    CVE-2020-8608:
    In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code.

    CVE-2020-10756:
    An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before4.3.1.

    CVE-2021-3595:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability isto data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-20188:
    A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the runc package has been released.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4297-1 advisory.

    It was discovered that runC incorrectly checked mount targets. An attacker with a malicious container     image could possibly mount over the /proc directory and escalate privileges. This issue only affected     Ubuntu 18.04 LTS. (CVE-2019-16884)

    It was discovered that runC incorrectly performed access control. An attacker could possibly use this     issue to escalate privileges. (CVE-2019-19921)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for runc fixes the following issues :

Security issue fixed :

CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)

Non-security issues fixed: Includes upstreamed patches for regressions (bsc#1131314 bsc#1131553).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4867-1 advisory.

    It was discovered that runC incorrectly checked mount targets. An attacker with a malicious container     image could possibly mount over the /proc directory and escalate privileges. (CVE-2019-16884)

    Etienne Champetier discovered that runC incorrectly checked mount targets. An attacker with a malicious     container image could possibly mount the host filesystem into the container and escalate privileges.
    (CVE-2021-30465)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3322 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3322-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     February 18, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : golang-github-opencontainers-selinux     Version        : 1.0.0~rc1+git20170621.5.4a2974b-1+deb10u1     CVE ID         : CVE-2019-16884     Debian Bug     : 942027

    runc, as used in Docker and other products, allows AppArmor and     SELinux restriction bypass, and thus a malicious Docker image could     breach isolation.

    This update carries SELinux-related fixes in the     golang-github-opencontainers-selinux library, that will be leveraged     in the upcoming runc security update.

    For Debian 10 buster, this problem has been fixed in version     1.0.0~rc1+git20170621.5.4a2974b-1+deb10u1.

    We recommend that you upgrade your golang-github-opencontainers-selinux packages.

    For the detailed security status of golang-github-opencontainers-selinux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/golang-github-opencontainers-selinux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3369 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3369-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     March 27, 2023                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : runc     Version        : 1.0.0~rc6+dfsg1-3+deb10u2     CVE ID         : CVE-2019-16884 CVE-2019-19921 CVE-2021-30465 CVE-2022-29162                      CVE-2023-27561     Debian Bug     : 942026 988768

    Multiple vulnerabilities were discovered in runc, the Open Container     Project runtime, which is often used with virtualization environments     such as Docker. Malicious Docker images or OCI bundles could breach     isolation.

    CVE-2019-16884

        runc, as used in Docker and other products, allows AppArmor and         SELinux restriction bypass because libcontainer/rootfs_linux.go         incorrectly checks mount targets, and thus a malicious Docker         image can mount over a /proc directory.

    CVE-2019-19921

        runc has Incorrect Access Control leading to Escalation of         Privileges, related to libcontainer/rootfs_linux.go. To exploit         this, an attacker must be able to spawn two containers with custom         volume-mount configurations, and be able to run custom         images. (This vulnerability does not affect Docker due to an         implementation detail that happens to block the attack.)

    CVE-2021-30465

        runc allows a Container Filesystem Breakout via Directory         Traversal. To exploit the vulnerability, an attacker must be able         to create multiple containers with a fairly specific mount         configuration. The problem occurs via a symlink-exchange attack         that relies on a race condition.

    CVE-2022-29162

        `runc exec --cap` created processes with non-empty inheritable         Linux process capabilities, creating an atypical Linux environment         and enabling programs with inheritable file capabilities to         elevate those capabilities to the permitted set during         execve(2). This bug did not affect the container security sandbox         as the inheritable set never contained more capabilities than were         included in the container's bounding set.

    CVE-2023-27561

        CVE-2019-19921 was re-introduced by the fix for CVE-2021-30465.

    For Debian 10 buster, this problem has been fixed in version     1.0.0~rc6+dfsg1-3+deb10u2.

    We recommend that you upgrade your runc packages.

    For the detailed security status of runc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/runc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-4546:03 advisory.

    * runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)
      * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)
      * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:3940 advisory.

  - runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the kapacitor package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
134598	GLSA-202003-21 : runC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/16	2024/3/22	high
204388	Photon OS 5.0: Telegraf PHSA-2023-5.0-0041	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/8/21	high
236506	Alibaba Cloud Linux 3 : 0110: container-tools:rhel8 (ALINUX3-SA-2022:0110)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/15	high
276379	TencentOS Server 3: container-tools:rhel8 (TSSA-2022:0110)	Nessus	Tencent Local Security Checks	2025/11/20	2026/3/10	high
299589	Photon OS 4.0: Runc PHSA-2026-4.0-0964	Nessus	PhotonOS Local Security Checks	2026/2/19	2026/2/19	high
134367	Ubuntu 18.04 LTS : runC vulnerabilities (USN-4297-1)	Nessus	Ubuntu Local Security Checks	2020/3/10	2025/9/3	high
130391	SUSE SLES15 Security Update : runc (SUSE-SU-2019:2810-1)	Nessus	SuSE Local Security Checks	2019/10/30	2024/4/16	high
183697	Ubuntu 16.04 ESM : runC vulnerabilities (USN-4867-1)	Nessus	Ubuntu Local Security Checks	2023/10/23	2024/8/27	high
171691	Debian dla-3322 : golang-github-opencontainers-selinux-dev - security update	Nessus	Debian Local Security Checks	2023/2/21	2025/1/22	high
173457	Debian dla-3369 : golang-github-opencontainers-runc-dev - security update	Nessus	Debian Local Security Checks	2023/3/28	2025/1/22	high
294760	MiracleLinux 7 : docker-1.13.1-161.git64e9980.0.1.el7.AXS7 (AXSA:2020-4546:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
312417	RHCOS 4 : OpenShift Container Platform 4.1.24 runc (RHSA-2019:3940)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/6	high
332194	Photon OS 5.0: Kapacitor PHSA-2023-5.0-91-0045	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/6	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

critical