runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-umountUpgrade oci-systemd-hook | May 13, 2022 | Sep 25, 2019 |
| Alpine Linux | — | Upgrade runcUpgrade containerd | Aug 22, 2024 | Sep 25, 2019 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Jul 4, 2022 | Sep 25, 2019 |
| Amazon_linux | — | Upgrade runc | Jan 12, 2022 | Sep 25, 2019 |
| Centos_linux | — | Upgrade oci-systemd-hookUpgrade skopeo-debuginfoUpgrade runc-debugsourceUpgrade podman-testsUpgrade oci-systemd-hook-debuginfoUpgrade container-selinuxUpgrade python-podman-apiUpgrade docker-clientUpgrade oci-umount-debugsourceUpgrade docker-logrotateUpgrade buildah-tests-debuginfoUpgrade slirp4netnsUpgrade podman-debugsourceUpgrade docker-rhel-push-pluginUpgrade slirp4netns-debuginfoUpgrade docker-debuginfoUpgrade oci-umount-debuginfoUpgrade podman-dockerUpgrade buildahUpgrade cockpit-podmanUpgrade oci-systemd-hook-debugsourceUpgrade podman-manpagesUpgrade buildah-testsUpgrade skopeo-debugsourceUpgrade buildah-debuginfoUpgrade slirp4netns-debugsourceUpgrade containers-commonUpgrade docker-lvm-pluginUpgrade podman-remote-debuginfoUpgrade fuse-overlayfsUpgrade oci-umountUpgrade runc-debuginfoUpgrade toolboxUpgrade runcUpgrade skopeo-testsUpgrade containernetworking-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade skopeoUpgrade dockerUpgrade docker-v1.10-migratorUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade docker-commonUpgrade podmanUpgrade fuse-overlayfs-debugsourceUpgrade docker-novolume-pluginUpgrade podman-remoteUpgrade podman-debuginfoUpgrade containernetworking-plugins-debugsource | Dec 18, 2019 | Sep 25, 2019 |
| Debian | — | Upgrade runcUpgrade golang-github-opencontainers-selinux | Feb 21, 2023 | Sep 25, 2019 |
| Docker_ce | — | Upgrade Docker CE to the latest version | Nov 25, 2019 | Sep 25, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Sep 25, 2019 |
| Oracle_linux | — | Upgrade cockpit-podmanUpgrade buildahUpgrade podmanUpgrade skopeoUpgrade fuse-overlayfsUpgrade python-podman-apiUpgrade buildah-testsUpgrade containers-commonUpgrade oci-umountUpgrade podman-manpagesUpgrade container-selinuxUpgrade runcUpgrade skopeo-testsUpgrade podman-testsUpgrade podman-dockerUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade slirp4netnsUpgrade oci-systemd-hook | Oct 5, 2022 | Sep 22, 2019 |
| Redhat Openshift | — | Upgrade runc | Nov 22, 2019 | Sep 22, 2019 |
| Redhat_linux | — | Upgrade oci-systemd-hook-debuginfoUpgrade podman-remote-debuginfoUpgrade runcUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade containernetworking-pluginsUpgrade podmanUpgrade skopeo-testsUpgrade podman-remoteUpgrade oci-umount-debugsourceUpgrade python-podman-apiUpgrade runc-debugsourceUpgrade podman-dockerUpgrade containernetworking-plugins-debuginfoUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade oci-systemd-hookNo solution existsUpgrade container-selinuxUpgrade podman-manpagesUpgrade podman-debugsourceUpgrade buildahUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade containers-commonUpgrade oci-systemd-hook-debugsourceUpgrade buildah-testsUpgrade fuse-overlayfs-debuginfoUpgrade oci-umount-debuginfoUpgrade skopeo-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netnsUpgrade buildah-debuginfoUpgrade skopeoUpgrade oci-umountUpgrade buildah-tests-debuginfoUpgrade cockpit-podmanUpgrade buildah-debugsourceUpgrade toolboxUpgrade fuse-overlayfsUpgrade podman-tests | Dec 18, 2019 | Sep 25, 2019 |
| Rocky_linux | — | Upgrade oci-umount-debugsourceUpgrade oci-systemd-hookUpgrade oci-systemd-hook-debuginfoUpgrade oci-umountUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount-debuginfo | Mar 12, 2024 | Sep 25, 2019 |
| Suse | — | Upgrade docker-testUpgrade docker-zsh-completionUpgrade docker-runcUpgrade golang-github-docker-libnetworkUpgrade containerd-ctrUpgrade dockerUpgrade docker-libnetworkUpgrade docker-bash-completionUpgrade containerdUpgrade runc | Nov 1, 2019 | Sep 25, 2019 |
| Ubuntu | — | Upgrade runcUpgrade runc (Ubuntu Pro) | Mar 10, 2020 | Sep 25, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 25, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub