{"answers":{"affected":"3 open source packages ship an affected version, including github.com/opencontainers/runc. It affects 2 products.","exploited":"There is no known exploitation of CVE-2021-43784 in the wild and no public exploit code.","fix":"Upgrade github.com/opencontainers/runc to a fixed version for your release line: 1.0.3 or 1.1.0.","what":"CVE-2021-43784 is a medium-severity vulnerability in Debian Debian Linux, published on 6 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-43784 and fix it if it is affected.\n\nWhat it is: CVE-2021-43784 is a medium-severity vulnerability in Debian Debian Linux, published on 6 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-43784 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/opencontainers/runc (Go): affected all versions; fixed in 1.0.3\n- github.com/opencontainers/runc (Go): affected all versions; fixed in 1.0.3\n- github.com/opencontainers/runc (Go): affected from 1.0.1-0.20211012131345-9c444070ec7b; fixed in 1.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-43784/ (Markdown: https://insights.sbomify.com/CVE-2021-43784/index.md)","id":"CVE-2021-43784","markdown":"https://insights.sbomify.com/CVE-2021-43784/index.md","name":"CVE-2021-43784","record":{"aliases":["AZL-6682","CLEANSTART-2026-DZ88951","DEBIAN-CVE-2021-43784","DLA-2841-1","GHSA-v95c-p5hm-xq8f","GO-2022-0274","MGASA-2021-0553","SUSE-SU-2021:4059-1","SUSE-SU-2021:4171-1","UBUNTU-CVE-2021-43784","openSUSE-SU-2021:1625-1","openSUSE-SU-2021:4171-1","openSUSE-SU-2024:11664-1"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"upgrade","impacts":["privilege_escalation","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"runc container runtime","requires_auth":"low_privilege","summary":"An integer overflow in runc allows attackers with container configuration control to bypass namespace restrictions and escape the container.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"runc","vendor":"linuxfoundation"}],"cvss":{"score":6,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"description":"runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.","ecosystems":["Go","SUSE:Enterprise Storage 7","SUSE:Linux Enterprise Micro 5.0","SUSE:Linux Enterprise Micro 5.1","SUSE:Linux Enterprise Module for Containers 12","SUSE:Linux Enterprise Module for Containers 15 SP2","SUSE:Linux Enterprise Module for Containers 15 SP3","openSUSE:Leap 15.2","openSUSE:Leap 15.3","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration","id":"CVE-2021-43784","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":"debian:debian_linux","products":["debian:debian_linux"],"type":"integer_overflow","year":"2021"},"n_packages":12,"n_references":7,"next":{"headline":"Cross Site Scripting Vulnerability in @joeattardi/emoji-button","id":"CVE-2021-43785"},"packages":[{"ecosystem":"Go","fixed":["1.0.3"],"introduced":["0"],"last_affected":[],"package":"github.com/opencontainers/runc","purl":null,"source":"GHSA-v95c-p5hm-xq8f"},{"ecosystem":"Go","fixed":["1.0.3"],"introduced":["0"],"last_affected":[],"package":"github.com/opencontainers/runc","purl":"pkg:golang/github.com/opencontainers/runc","source":"GHSA-v95c-p5hm-xq8f"},{"ecosystem":"Go","fixed":["1.1.0"],"introduced":["1.0.1-0.20211012131345-9c444070ec7b"],"last_affected":[],"package":"github.com/opencontainers/runc","purl":"pkg:golang/github.com/opencontainers/runc","source":"GO-2022-0274"},{"ecosystem":"SUSE:Enterprise Storage 7","fixed":["1.0.3-27.1"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/suse/runc\u0026distro=SUSE%20Enterprise%20Storage%207","source":"SUSE-SU-2021:4171-1"},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","fixed":["1.0.3-27.1"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/suse/runc\u0026distro=SUSE%20Linux%20Enterprise%20Micro%205.0","source":"SUSE-SU-2021:4171-1"},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","fixed":["1.0.3-27.1"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/suse/runc\u0026distro=SUSE%20Linux%20Enterprise%20Micro%205.1","source":"SUSE-SU-2021:4171-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","fixed":["1.0.3-16.18.1"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/suse/runc\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2012","source":"SUSE-SU-2021:4059-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP2","fixed":["1.0.3-27.1"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/suse/runc\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP2","source":"SUSE-SU-2021:4171-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","fixed":["1.0.3-27.1"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/suse/runc\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP3","source":"SUSE-SU-2021:4171-1"},{"ecosystem":"openSUSE:Leap 15.2","fixed":["1.0.3-lp152.2.12.1"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/opensuse/runc\u0026distro=openSUSE%20Leap%2015.2","source":"openSUSE-SU-2021:1625-1"},{"ecosystem":"openSUSE:Leap 15.3","fixed":["1.0.3-27.1"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/opensuse/runc\u0026distro=openSUSE%20Leap%2015.3","source":"openSUSE-SU-2021:4171-1"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["1.0.3-1.1"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/opensuse/runc\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2024:11664-1"}],"prev":{"headline":"Path Traversal in @backstage/plugin-scaffolder-backend","id":"CVE-2021-43783"},"products":["runc"],"published":"2021-12-06","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-10-15","vendors":["opencontainers"]},"summary":"An integer overflow in runc allows attackers with container configuration control to bypass namespace restrictions and escape the container.","url":"https://insights.sbomify.com/CVE-2021-43784/"}