CVE-2019-19921: Opencontainers Runc Procfs Race Condition Vulnerability
Summary
CVE-2019-19921: opencontainers runc contains procfs race condition with a shared volume mount. Affects github.com/opencontainers/runc versions < 1.0.0-rc9.0.20200122160610-2fc03cc11c77. Fixed in 1.0.0-rc9.0.20200122160610-2fc03cc11c77. How to fix ↓
Also tracked for
- runc · Debian:11
The same CVE-2019-19921 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Opencontainers runc is an open-source command-line tool for spawning and running containers according to the Open Container Initiative (OCI) specification. It provides a lightweight and portable runtime for containerized applications. The vulnerability described here affects versions prior to 1.0.0-rc10 of the runc package.
Vulnerability Detail
The vulnerability in opencontainers runc involves a race condition in the handling of shared volume mounts with the procfs filesystem. By creating a malicious root filesystem where the /proc directory is a symlink to a directory inside a volume shared with another running container, an attacker who controls both containers can exploit this race condition. This can lead to misconfiguration of the container's security labels and the exposure of potentially sensitive information about the host system. In some cases, it may even allow direct attacks against the host. Exploiting this vulnerability requires the ability to spawn custom containers with custom mount configurations, which typically requires a high level of access for an untrusted user.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0-rc9.0.20200122160610-2fc03cc11c77
This is the first release that contains the fix.
go get github.com/opencontainers/runc@v1.0.0-rc9.0.20200122160610-2fc03cc11c77Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If untrusted users do not have the ability to configure mountpoints for runc or use higher-level tools like docker run -v, they are not vulnerable to this issue. This vulnerability requires complex levels of access that may not be available in all deployments. Additionally, it appears that this vulnerability cannot be exploited through Docker due to the order of mounts Docker generates, but this should not be relied upon as a definitive protection.
Conclusion
The Opencontainers runc Procfs Race Condition Vulnerability (CVE-2019-19921) allows an attacker to manipulate container security labels and access potentially sensitive information about the host system. It is recommended to update to version 1.0.0-rc10 or later of the runc package to mitigate this vulnerability. Access policies should also be reviewed to restrict untrusted users from having high levels of control over container mount configuration. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
Opencontainers runc is an open-source command-line tool for running containers according to the Open Container Initiative (OCI) specification. It provides a lightweight and portable runtime for containerized applications.
By exploiting this vulnerability, an attacker who controls both containers can manipulate the container's security labels and access potentially sensitive information about the host system. In some cases, it may even allow direct attacks against the host.
To fix this vulnerability, update the runc package to version 1.0.0-rc10 or later. Additionally, review access policies to restrict untrusted users from having high levels of control over container mount configuration.
If untrusted users do not have the ability to configure mountpoints for runc or use higher-level tools like docker run -v, they are not vulnerable to this issue. However, it is recommended to update to the fixed version of the runc package.
It appears that this vulnerability cannot be exploited through Docker due to the order of mounts Docker generates. However, this should not be relied upon as a definitive protection.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
