Описание
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u (--user) is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.
A flaw was found in crun, an open-source OCI Container Runtime. A local user can exploit this vulnerability due to incorrect parsing of the --user option when using crun exec. The value 1 is misinterpreted as root privileges (User ID 0 and Group ID 0) instead of the intended User ID 1 and Group ID 0. This allows a process to run with higher privileges than expected, leading to privilege escalation.
Отчет
Red Hat has rated this vulnerability as Moderate because the flaw exists in the OCI container runtime crun. When crun exec -u 1 is used, crun incorrectly interprets UID 1 as UID 0 (root), causing the executed process to run with root privileges inside the container instead of as the intended unprivileged user. Successful exploitation requires local access to container management operations. An attacker must already have the ability to invoke crun exec against an existing container. The vulnerability is not remotely exploitable and cannot be triggered by an unauthenticated attacker. Additionally, the privilege escalation is limited to the container context. While the flaw allows an attacker to obtain root privileges within the affected container, there is no demonstrated container escape or direct compromise of the host system resulting from this issue alone.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | container-tools:rhel8/crun | Not affected | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Affected | ||
| Red Hat Enterprise Linux 10 | crun | Fixed | RHSA-2026:6622 | 06.04.2026 |
| Red Hat Enterprise Linux 10 | crun | Fixed | RHSA-2026:19020 | 19.05.2026 |
| Red Hat Enterprise Linux 9 | crun | Fixed | RHSA-2026:19178 | 19.05.2026 |
| Red Hat Enterprise Linux 9 | crun | Fixed | RHSA-2026:6621 | 06.04.2026 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | crun | Fixed | RHSA-2026:28036 | 22.06.2026 |
| Red Hat OpenShift Container Platform 4.19 | rhcos-4.19.9.6.202606302000 | Fixed | RHSA-2026:34757 | 09.07.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.
crun is an open source OCI Container Runtime fully written in C. In ve ...
EPSS
7.8 High
CVSS3