runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-catatonitUpgrade critUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade libslirp-develUpgrade aardvark-dnsUpgrade runcUpgrade buildah-testsUpgrade container-selinuxUpgrade containers-commonUpgrade podman-remoteUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade criu-libsUpgrade criu-develUpgrade criuUpgrade libslirpUpgrade toolbox-testsUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade skopeo-testsUpgrade conmonUpgrade podman-pluginsUpgrade toolboxUpgrade udicaUpgrade crunUpgrade podman-testsUpgrade podman-dockerUpgrade python3-podmanUpgrade skopeoUpgrade podman-gvproxyUpgrade netavark | Nov 16, 2023 | Mar 29, 2023 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | Mar 29, 2023 |
| Amazon Linux Ami 2 | — | Upgrade runc-debuginfoUpgrade runc | Jun 7, 2023 | Mar 29, 2023 |
| Amazon_linux_2023 | — | Upgrade runc-debuginfoUpgrade runcUpgrade runc-debugsource | Feb 17, 2025 | Mar 29, 2023 |
| Centos_linux | — | Upgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-testsUpgrade conmonUpgrade crunUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade toolboxUpgrade criuUpgrade slirp4netnsUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade netavarkUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade podmanUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-dockerUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxyUpgrade crun-debuginfoUpgrade python3-podmanUpgrade skopeo-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeoUpgrade podman-catatonit-debuginfoUpgrade runc-debuginfoUpgrade libslirpUpgrade criu-develUpgrade libslirp-debuginfoUpgrade runcUpgrade buildah-testsUpgrade udicaUpgrade podman-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade buildahUpgrade crun-debugsourceUpgrade podman-debuginfoUpgrade criu-libsUpgrade containers-commonUpgrade container-selinuxUpgrade cockpit-podmanUpgrade slirp4netns-debuginfoUpgrade runc-debugsourceUpgrade containernetworking-pluginsUpgrade buildah-tests-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade critUpgrade toolbox-debuginfoUpgrade podman-debugsourceUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade libslirp-develUpgrade criu-debugsourceUpgrade aardvark-dnsUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade criu-libs-debuginfoUpgrade conmon-debuginfoUpgrade toolbox-testsUpgrade oci-seccomp-bpf-hookUpgrade criu-debuginfoUpgrade skopeo-debugsource | Nov 8, 2023 | Mar 29, 2023 |
| Debian | — | Upgrade runc | Mar 31, 2023 | Mar 29, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | Mar 29, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Jan 10, 2024 | Mar 29, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade docker-runc | Aug 9, 2023 | Mar 29, 2023 |
| Oracle_linux | — | Upgrade python3-criuUpgrade crunUpgrade runcUpgrade udicaUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade podman-remoteUpgrade skopeo-testsUpgrade critUpgrade container-selinuxUpgrade podman-testsUpgrade containers-commonUpgrade criu-libsUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade criu-develUpgrade podmanUpgrade buildahUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade conmonUpgrade criuUpgrade python3-podmanUpgrade netavarkUpgrade skopeoUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade buildah-testsUpgrade libslirpUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade podman-docker | Jul 20, 2023 | Mar 29, 2023 |
| Redhat_linux | — | Upgrade podman-remoteUpgrade crun-debugsourceUpgrade criu-develUpgrade udicaUpgrade criu-libs-debuginfoUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade container-selinuxUpgrade runc-debuginfoUpgrade buildah-testsUpgrade podman-plugins-debuginfoUpgrade critUpgrade python3-criuUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-debuginfoUpgrade slirp4netns-debugsourceUpgrade libslirp-debuginfoUpgrade podman-debugsourceUpgrade runc-debugsourceUpgrade cockpit-podmanUpgrade containernetworking-pluginsNo solution existsUpgrade runcUpgrade aardvark-dnsUpgrade conmon-debuginfoUpgrade toolbox-debuginfoUpgrade skopeo-testsUpgrade libslirp-debugsourceUpgrade criu-debugsourceUpgrade skopeo-debuginfoUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfsUpgrade criuUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade netavarkUpgrade libslirp-develUpgrade buildahUpgrade libslirpUpgrade podman-testsUpgrade skopeoUpgrade podman-catatonitUpgrade criu-debuginfoUpgrade buildah-debugsourceUpgrade podman-dockerUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade podmanUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debuginfoUpgrade crun-debuginfoUpgrade containers-commonUpgrade toolbox-testsUpgrade crunUpgrade python3-podmanUpgrade toolboxUpgrade criu-libsUpgrade fuse-overlayfs-debuginfoUpgrade conmon-debugsource | Nov 8, 2023 | Mar 29, 2023 |
| Rocky_linux | — | Upgrade podman-testsUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade libslirp-debuginfoUpgrade buildah-tests-debuginfoUpgrade aardvark-dnsUpgrade conmon-debugsourceUpgrade crun-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netnsUpgrade criu-libs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade libslirpUpgrade podman-catatonitUpgrade conmon-debuginfoUpgrade runc-debugsourceUpgrade python3-criuUpgrade buildah-testsUpgrade criuUpgrade criu-debugsourceUpgrade podman-gvproxyUpgrade buildahUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade crun-debugsourceUpgrade podman-remoteUpgrade podmanUpgrade podman-remote-debuginfoUpgrade runc-debuginfoUpgrade critUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade conmonUpgrade containers-commonUpgrade podman-pluginsUpgrade podman-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade criu-develUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade containernetworking-plugins-debugsourceUpgrade runcUpgrade criu-libsUpgrade libslirp-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade netavarkUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debuginfo | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade runc | Apr 4, 2023 | Mar 29, 2023 |
| Ubuntu | — | Upgrade runc (Ubuntu Pro)Upgrade runc | May 19, 2023 | Mar 29, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub