runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-systemd-hookUpgrade oci-umount | May 13, 2022 | Sep 25, 2019 |
| Alpine Linux | — | Upgrade containerdUpgrade runc | Aug 22, 2024 | Sep 25, 2019 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Jul 4, 2022 | Sep 25, 2019 |
| Amazon_linux | — | Upgrade runc | Jan 12, 2022 | Sep 25, 2019 |
| Centos_linux | — | Upgrade fuse-overlayfs-debuginfoUpgrade podman-debuginfoUpgrade skopeoUpgrade oci-umountUpgrade fuse-overlayfsUpgrade containers-commonUpgrade podman-remoteUpgrade podman-remote-debuginfoUpgrade docker-commonUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade runc-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade podmanUpgrade docker-v1.10-migratorUpgrade docker-novolume-pluginUpgrade runcUpgrade toolboxUpgrade containernetworking-pluginsUpgrade docker-lvm-pluginUpgrade dockerUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade skopeo-debuginfoUpgrade skopeo-debugsourceUpgrade container-selinuxUpgrade buildah-testsUpgrade python-podman-apiUpgrade oci-systemd-hook-debuginfoUpgrade podman-manpagesUpgrade docker-debuginfoUpgrade oci-systemd-hookUpgrade podman-testsUpgrade oci-umount-debugsourceUpgrade buildah-debuginfoUpgrade docker-clientUpgrade slirp4netnsUpgrade buildahUpgrade runc-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade docker-rhel-push-pluginUpgrade podman-dockerUpgrade docker-logrotateUpgrade oci-umount-debuginfoUpgrade podman-debugsourceUpgrade buildah-tests-debuginfoUpgrade slirp4netns-debuginfoUpgrade cockpit-podman | Dec 18, 2019 | Sep 25, 2019 |
| Debian | — | Upgrade runcUpgrade golang-github-opencontainers-selinux | Feb 21, 2023 | Sep 25, 2019 |
| Docker_ce | — | Upgrade Docker CE to the latest version | Nov 25, 2019 | Sep 25, 2019 |
| Gentoo Linux | — | Upgrade app-emulation/runc. | Mar 16, 2020 | Sep 25, 2019 |
| Oracle_linux | — | Upgrade python-podman-apiUpgrade buildahUpgrade oci-umountUpgrade buildah-testsUpgrade podmanUpgrade skopeoUpgrade cockpit-podmanUpgrade containers-commonUpgrade fuse-overlayfsUpgrade skopeo-testsUpgrade runcUpgrade podman-dockerUpgrade container-selinuxUpgrade oci-systemd-hookUpgrade slirp4netnsUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade podman-manpagesUpgrade podman-tests | Oct 5, 2022 | Sep 22, 2019 |
| Redhat Openshift | — | Upgrade runc | Nov 22, 2019 | Sep 22, 2019 |
| Redhat_linux | — | Upgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade podman-remote-debuginfoUpgrade oci-systemd-hookUpgrade podman-manpagesUpgrade slirp4netns-debuginfoUpgrade skopeo-testsNo solution existsUpgrade podman-dockerUpgrade podman-debuginfoUpgrade podman-debugsourceUpgrade oci-umount-debugsourceUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade python-podman-apiUpgrade runc-debuginfoUpgrade container-selinuxUpgrade runcUpgrade podmanUpgrade runc-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade containers-commonUpgrade podman-testsUpgrade oci-systemd-hook-debugsourceUpgrade buildahUpgrade skopeo-debuginfoUpgrade buildah-testsUpgrade fuse-overlayfs-debugsourceUpgrade skopeoUpgrade toolboxUpgrade cockpit-podmanUpgrade buildah-debuginfoUpgrade oci-umountUpgrade slirp4netnsUpgrade buildah-tests-debuginfoUpgrade buildah-debugsourceUpgrade oci-umount-debuginfoUpgrade fuse-overlayfs | Dec 18, 2019 | Sep 25, 2019 |
| Rocky_linux | — | Upgrade oci-systemd-hookUpgrade oci-systemd-hook-debuginfoUpgrade oci-umount-debugsourceUpgrade oci-umountUpgrade oci-umount-debuginfoUpgrade oci-systemd-hook-debugsource | Mar 12, 2024 | Sep 25, 2019 |
| Suse | — | Upgrade containerd-ctrUpgrade docker-testUpgrade docker-zsh-completionUpgrade golang-github-docker-libnetworkUpgrade docker-runcUpgrade docker-libnetworkUpgrade runcUpgrade containerdUpgrade dockerUpgrade docker-bash-completion | Nov 1, 2019 | Sep 25, 2019 |
| Ubuntu | — | Upgrade runc (Ubuntu Pro)Upgrade runc | Mar 10, 2020 | Sep 25, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 25, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub