x/vulndb: potential Go vuln in github.com/opencontainers/runc: GHSA-vpvm-3wq2-2wvm

[GoVulnBot]

In GitHub Security Advisory GHSA-vpvm-3wq2-2wvm, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/opencontainers/runc		<= 1.1.4

Cross references:

• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: GHSA-g54h-m393-cpwq #396 EFFECTIVELY_PRIVATE
• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: CVE-2022-29162 #452 EFFECTIVELY_PRIVATE
• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: GHSA-gp4j-w3vj-7299 #835 NOT_IMPORTABLE
• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: CVE-2021-30465, GHSA-c3xm-pvg7-gh7r #914 NOT_IMPORTABLE
• Module github.com/opencontainers/runc appears in issue dummy issue #70
• Module github.com/opencontainers/runc appears in issue dummy issue #85
• Module github.com/opencontainers/runc appears in issue dummy issue #87
• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: CVE-2021-43784 #274

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/opencontainers/runc
    versions:
      - {}
    packages:
      - package: github.com/opencontainers/runc
description: 'runc through 1.1.4 has Incorrect Access Control leading to Escalation
    of Privileges, related to `libcontainer/rootfs_linux.go`. To exploit this, an
    attacker must be able to spawn two containers with custom volume-mount configurations,
    and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921
    regression.'
cves:
  - CVE-2023-27561
ghsas:
  - GHSA-vpvm-3wq2-2wvm
references:
  - web: https://nvd.nist.gov/vuln/detail/CVE-2023-27561
  - report: https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334
  - report: https://github.com/opencontainers/runc/issues/3751
  - web: https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9
  - advisory: https://github.com/advisories/GHSA-vpvm-3wq2-2wvm

[gopherbot]

Change https://go.dev/cl/475915 mentions this issue: data/excluded: batch add GO-2023-1629, GO-2023-1628, GO-2023-1627, GO-2023-1622

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606783 mentions this issue: data/reports: unexclude 20 reports (3)