Operation on a Resource after Expiration or Release The advisory has been revoked - it doesn't affect any version of package fuse-overlayfs (opens in a new tab)

Threat Intelligence

Proof of Concept

98.45% (100^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-RHEL8-FUSEOVERLAYFS-1367921
published26 Jul 2021
disclosed11 Feb 2019

Report a new vulnerability Found a mistake?

Introduced: 11 Feb 2019

CVE-2019-5736 (opens in a new tab) CWE-672 (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream fuse-overlayfs package and not the fuse-overlayfs package as distributed by RHEL.

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.