runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-criuUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade critUpgrade criu-libsUpgrade aardvark-dnsUpgrade container-selinuxUpgrade runcUpgrade fuse-overlayfsUpgrade buildah-testsUpgrade podmanUpgrade containers-commonUpgrade libslirp-develUpgrade podman-remoteUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade podman-gvproxyUpgrade crunUpgrade podman-pluginsUpgrade conmonUpgrade toolboxUpgrade python3-podmanUpgrade skopeoUpgrade cockpit-podmanUpgrade skopeo-testsUpgrade podman-dockerUpgrade netavarkUpgrade udicaUpgrade podman-testsUpgrade libslirpUpgrade criuUpgrade criu-develUpgrade toolbox-testsUpgrade slirp4netns | Nov 16, 2023 | Mar 29, 2023 |
| Alpine Linux | — | Upgrade runc | Aug 22, 2024 | Mar 29, 2023 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade runc-debuginfo | Jun 7, 2023 | Mar 29, 2023 |
| Amazon_linux_2023 | — | Upgrade runc-debugsourceUpgrade runc-debuginfoUpgrade runc | Feb 17, 2025 | Mar 29, 2023 |
| Centos_linux | — | Upgrade toolbox-testsUpgrade oci-seccomp-bpf-hookUpgrade buildah-debuginfoUpgrade skopeo-debugsourceUpgrade criu-debuginfoUpgrade podman-debuginfoUpgrade buildah-tests-debuginfoUpgrade critUpgrade fuse-overlayfs-debugsourceUpgrade podman-remoteUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade criu-libsUpgrade container-selinuxUpgrade runc-debugsourceUpgrade python3-criuUpgrade toolbox-debugsourceUpgrade aardvark-dnsUpgrade slirp4netns-debuginfoUpgrade libslirp-develUpgrade libslirp-debugsourceUpgrade podman-debugsourceUpgrade podman-plugins-debuginfoUpgrade crun-debugsourceUpgrade criu-debugsourceUpgrade conmon-debuginfoUpgrade buildahUpgrade toolbox-debuginfoUpgrade libslirp-debuginfoUpgrade runcUpgrade podman-gvproxy-debuginfoUpgrade cockpit-podmanUpgrade criu-libs-debuginfoUpgrade udicaUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade slirp4netnsUpgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criuUpgrade skopeo-testsUpgrade containernetworking-plugins-debugsourceUpgrade podman-pluginsUpgrade buildah-debugsourceUpgrade toolboxUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade netavarkUpgrade fuse-overlayfs-debuginfoUpgrade podmanUpgrade fuse-overlayfsUpgrade runc-debuginfoUpgrade criu-develUpgrade skopeoUpgrade libslirpUpgrade crun-debuginfoUpgrade python3-podmanUpgrade slirp4netns-debugsourceUpgrade skopeo-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podman-dockerUpgrade podman-remote-debuginfoUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debugsource | Nov 8, 2023 | Mar 29, 2023 |
| Debian | — | Upgrade runc | Mar 31, 2023 | Mar 29, 2023 |
| Gentoo Linux | — | Upgrade app-containers/runc. | Aug 12, 2024 | Mar 29, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-runc | Jan 10, 2024 | Mar 29, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade docker-runc | Aug 9, 2023 | Mar 29, 2023 |
| Oracle_linux | — | Upgrade slirp4netnsUpgrade podmanUpgrade netavarkUpgrade skopeoUpgrade podman-dockerUpgrade buildah-testsUpgrade podman-catatonitUpgrade buildahUpgrade podman-gvproxyUpgrade libslirpUpgrade python3-podmanUpgrade conmonUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade criuUpgrade criu-libsUpgrade critUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade container-selinuxUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade criu-develUpgrade udicaUpgrade runcUpgrade podman-testsUpgrade crunUpgrade python3-criuUpgrade podman-pluginsUpgrade skopeo-testsUpgrade podman-remote | Jul 20, 2023 | Mar 29, 2023 |
| Redhat_linux | — | Upgrade podman-remote-debuginfoUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-pluginsUpgrade podmanUpgrade criu-libsUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade conmonUpgrade libslirp-develUpgrade containernetworking-plugins-debugsourceUpgrade podman-dockerUpgrade podman-testsUpgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criuUpgrade podman-catatonitUpgrade netavarkUpgrade buildahUpgrade criu-debuginfoUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade crunUpgrade podman-gvproxyUpgrade skopeo-debuginfoUpgrade skopeoUpgrade fuse-overlayfsUpgrade buildah-debugsourceUpgrade python3-podmanUpgrade toolboxUpgrade buildah-debuginfoUpgrade crun-debuginfoUpgrade containers-commonUpgrade toolbox-testsUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade libslirp-debugsourceUpgrade toolbox-debuginfoUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade toolbox-debugsourceUpgrade libslirp-debuginfoUpgrade python3-criuUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade cockpit-podmanNo solution existsUpgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade crun-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-debuginfoUpgrade udicaUpgrade podman-remoteUpgrade container-selinuxUpgrade buildah-testsUpgrade conmon-debuginfoUpgrade criu-debugsourceUpgrade runcUpgrade criu-develUpgrade crit | Nov 8, 2023 | Mar 29, 2023 |
| Rocky_linux | — | Upgrade python3-criuUpgrade podman-catatonitUpgrade criu-debugsourceUpgrade criu-debuginfoUpgrade crun-debuginfoUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade criu-libs-debuginfoUpgrade conmon-debugsourceUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-testsUpgrade aardvark-dnsUpgrade criuUpgrade fuse-overlayfsUpgrade buildah-debuginfoUpgrade libslirpUpgrade conmon-debuginfoUpgrade runc-debugsourceUpgrade podman-gvproxyUpgrade buildahUpgrade conmonUpgrade runc-debuginfoUpgrade buildah-debugsourceUpgrade netavarkUpgrade containernetworking-plugins-debuginfoUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade criu-develUpgrade libslirp-develUpgrade criu-libsUpgrade podman-catatonit-debuginfoUpgrade containers-commonUpgrade slirp4netns-debugsourceUpgrade runcUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade podmanUpgrade podman-remoteUpgrade podman-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-pluginsUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debugsource | Dec 1, 2025 | Nov 28, 2025 |
| Suse | — | Upgrade runc | Apr 4, 2023 | Mar 29, 2023 |
| Ubuntu | — | Upgrade runcUpgrade runc (Ubuntu Pro) | May 19, 2023 | Mar 29, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub