runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-umountUpgrade oci-systemd-hook | May 13, 2022 | Sep 25, 2019 |
| Alpine Linux | — | Upgrade runcUpgrade containerd | Aug 22, 2024 | Sep 25, 2019 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Jul 4, 2022 | Sep 25, 2019 |
| Amazon_linux | — | Upgrade runc | Jan 12, 2022 | Sep 25, 2019 |
| Centos_linux | — | Upgrade containernetworking-plugins-debugsourceUpgrade podman-debuginfoUpgrade docker-lvm-pluginUpgrade skopeoUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade buildah-debugsourceUpgrade containernetworking-pluginsUpgrade runc-debuginfoUpgrade containers-commonUpgrade fuse-overlayfsUpgrade oci-umountUpgrade fuse-overlayfs-debugsourceUpgrade podman-remoteUpgrade podman-remote-debuginfoUpgrade runcUpgrade toolboxUpgrade docker-v1.10-migratorUpgrade dockerUpgrade docker-novolume-pluginUpgrade containernetworking-plugins-debuginfoUpgrade podmanUpgrade fuse-overlayfs-debuginfoUpgrade docker-commonUpgrade docker-debuginfoUpgrade slirp4netns-debuginfoUpgrade cockpit-podmanUpgrade buildah-testsUpgrade podman-manpagesUpgrade buildah-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade skopeo-debugsourceUpgrade runc-debugsourceUpgrade buildahUpgrade skopeo-debuginfoUpgrade podman-debugsourceUpgrade podman-dockerUpgrade oci-umount-debugsourceUpgrade oci-systemd-hookUpgrade docker-logrotateUpgrade buildah-tests-debuginfoUpgrade oci-umount-debuginfoUpgrade python-podman-apiUpgrade slirp4netnsUpgrade docker-clientUpgrade oci-systemd-hook-debuginfoUpgrade container-selinuxUpgrade podman-testsUpgrade docker-rhel-push-plugin | Dec 18, 2019 | Sep 25, 2019 |
| Debian | — | Upgrade golang-github-opencontainers-selinuxUpgrade runc | Feb 21, 2023 | Sep 25, 2019 |
| Docker_ce | — | Upgrade Docker CE to the latest version | Nov 25, 2019 | Sep 25, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Sep 25, 2019 |
| Oracle_linux | — | Upgrade skopeo-testsUpgrade runcUpgrade container-selinuxUpgrade podman-dockerUpgrade podman-manpagesUpgrade podman-testsUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade slirp4netnsUpgrade oci-systemd-hookUpgrade fuse-overlayfsUpgrade skopeoUpgrade python-podman-apiUpgrade buildahUpgrade podmanUpgrade buildah-testsUpgrade containers-commonUpgrade cockpit-podmanUpgrade oci-umount | Oct 5, 2022 | Sep 22, 2019 |
| Redhat Openshift | — | Upgrade runc | Nov 22, 2019 | Sep 22, 2019 |
| Redhat_linux | — | Upgrade containernetworking-plugins-debuginfoUpgrade oci-umount-debugsourceUpgrade podman-dockerUpgrade container-selinuxUpgrade podman-remoteUpgrade runc-debugsourceUpgrade slirp4netns-debuginfoNo solution existsUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade python-podman-apiUpgrade podman-debuginfoUpgrade podman-remote-debuginfoUpgrade podmanUpgrade runc-debuginfoUpgrade runcUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade oci-systemd-hookUpgrade podman-manpagesUpgrade skopeo-debugsourceUpgrade buildah-testsUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade skopeo-debuginfoUpgrade slirp4netnsUpgrade buildah-debuginfoUpgrade skopeoUpgrade oci-systemd-hook-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade oci-umount-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-testsUpgrade oci-umountUpgrade cockpit-podmanUpgrade toolboxUpgrade buildah | Dec 18, 2019 | Sep 25, 2019 |
| Rocky_linux | — | Upgrade oci-systemd-hookUpgrade oci-systemd-hook-debuginfoUpgrade oci-umount-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount-debuginfoUpgrade oci-umount | Mar 12, 2024 | Sep 25, 2019 |
| Suse | — | Upgrade containerdUpgrade runcUpgrade dockerUpgrade docker-libnetworkUpgrade docker-bash-completionUpgrade containerd-ctrUpgrade golang-github-docker-libnetworkUpgrade docker-testUpgrade docker-zsh-completionUpgrade docker-runc | Nov 1, 2019 | Sep 25, 2019 |
| Ubuntu | — | Upgrade runc (Ubuntu Pro)Upgrade runc | Mar 10, 2020 | Sep 25, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 25, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub