« Volver al listado

CVE-2026-41579

Estado: AnalizadaBaja (3.3)—

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory.

Leer descripción completaMostrar menos

This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linuxfoundation — Runc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-41579",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41579",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-01T13:34:05.348945Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "opencontainers",
          "product": "runc",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.3.6"
            },
            {
              "status": "affected",
              "version": ">= 1.4.0-rc.1, < 1.4.3"
            },
            {
              "status": "affected",
              "version": ">= 1.5.0-rc.1, < 1.5.0-rc.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-01T02:17:00.193",
  "references": [
    {
      "url": "https://github.com/opencontainers/runc/commit/864db8042dbb",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-61"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names and targets in an arbitrary pre-existing host directory. This issue is not exploitable under Docker, because Docker creates a top-level read-only layer that masks any malicious /dev symlink present in the container image — unlike some other Linux container tooling, whose higher-level runtimes built on runc remain exposed to exploitation via a malicious image. This issue has been fixed in versions 1.3.6, 1.4.3 and 1.5.0."
    }
  ],
  "lastModified": "2026-07-02T19:36:49.830",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66E8E6E0-E0A3-4C49-A418-D1CA76D0FAEF",
              "versionEndExcluding": "1.3.6"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3692DBD2-9876-4C63-8C93-2262F86EF95A",
              "versionEndExcluding": "1.4.3",
              "versionStartIncluding": "1.4.0"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:runc:1.5.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FEAC66F-F2B2-4B23-8061-3B8B44EAECD8"
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:runc:1.5.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED7FCB70-52A0-42C3-A10F-247FEF7AEC08"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}