CVE-2019-19921: Race condition in github.com/opencontainers/runc
Summary
CVE-2019-19921: Race condition in github.com/opencontainers/runc. Affects github.com/opencontainers/runc versions < 1.0.0-rc9.0.20200122160610-2fc03cc11c77. Fixed in 1.0.0-rc9.0.20200122160610-2fc03cc11c77. How to fix ↓
Also tracked for
- runc · Debian:11
The same CVE-2019-19921 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/opencontainers/runc, which is written in Go. It is a tool for spawning and running containers according to the Open Container Initiative (OCI) specification. It provides a runtime environment for containers and manages their lifecycle. The vulnerability in this package is related to a race condition that occurs while mounting volumes, which can potentially be exploited by a user who can start multiple containers with custom volume mount configurations to escape the container.
Vulnerability Detail
The vulnerability (CVE-2019-19921) is a race condition in github.com/opencontainers/runc. It allows a possible symlink-exchange attack, enabling a user to escape the container. The race condition occurs during the mounting of volumes, where multiple containers with custom volume mount configurations can be started simultaneously. This can lead to a situation where a symlink is replaced with a target file, allowing the attacker to escape the container and potentially access sensitive information or execute arbitrary code.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0-rc9.0.20200122160610-2fc03cc11c77
This is the first release that contains the fix.
go get github.com/opencontainers/runc@v1.0.0-rc9.0.20200122160610-2fc03cc11c77Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to update the package to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the vulnerability (CVE-2019-19921) in github.com/opencontainers/runc is a race condition that allows a possible symlink-exchange attack, enabling an attacker to escape the container. To fix this vulnerability, it is recommended to update the package to version 1.0.0-rc9.0.20200122160610-2fc03cc11c77 or later. There are no known public exploits for this vulnerability, but it is important to patch it as soon as possible to prevent any potential attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
This vulnerability allows an attacker to escape the container and potentially access sensitive information or execute arbitrary code.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the moment. However, it is important to patch the vulnerability as soon as possible to prevent any potential attacks.
There are alternative container runtimes available, such as Docker, that are not affected by this specific vulnerability. However, it is always recommended to keep all software components up to date to ensure the latest security patches are applied.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
