runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-oci-systemd-hookalma-upgrade-oci-umount | May 13, 2022 | Sep 25, 2019 | |
| Alpine Linux | alpine-linux-upgrade-containerdalpine-linux-upgrade-runc | Aug 22, 2024 | Sep 25, 2019 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-runcamazon-linux-ami-2-upgrade-runc-debuginfo | Jul 4, 2022 | Sep 25, 2019 | |
| Amazon_linux | — | amazon-linux-upgrade-runc | Jan 12, 2022 | Sep 25, 2019 |
| Centos_linux | — | centos-upgrade-buildahcentos-upgrade-buildah-debuginfocentos-upgrade-buildah-debugsourcecentos-upgrade-buildah-testscentos-upgrade-buildah-tests-debuginfocentos-upgrade-cockpit-podmancentos-upgrade-container-selinuxcentos-upgrade-containernetworking-pluginscentos-upgrade-containernetworking-plugins-debuginfocentos-upgrade-containernetworking-plugins-debugsourcecentos-upgrade-containers-commoncentos-upgrade-dockercentos-upgrade-docker-clientcentos-upgrade-docker-commoncentos-upgrade-docker-debuginfocentos-upgrade-docker-logrotatecentos-upgrade-docker-lvm-plugincentos-upgrade-docker-novolume-plugincentos-upgrade-docker-rhel-push-plugincentos-upgrade-docker-v1-10-migratorcentos-upgrade-fuse-overlayfscentos-upgrade-fuse-overlayfs-debuginfocentos-upgrade-fuse-overlayfs-debugsourcecentos-upgrade-oci-systemd-hookcentos-upgrade-oci-systemd-hook-debuginfocentos-upgrade-oci-systemd-hook-debugsourcecentos-upgrade-oci-umountcentos-upgrade-oci-umount-debuginfocentos-upgrade-oci-umount-debugsourcecentos-upgrade-podmancentos-upgrade-podman-debuginfocentos-upgrade-podman-debugsourcecentos-upgrade-podman-dockercentos-upgrade-podman-manpagescentos-upgrade-podman-remotecentos-upgrade-podman-remote-debuginfocentos-upgrade-podman-testscentos-upgrade-python-podman-apicentos-upgrade-runccentos-upgrade-runc-debuginfocentos-upgrade-runc-debugsourcecentos-upgrade-skopeocentos-upgrade-skopeo-debuginfocentos-upgrade-skopeo-debugsourcecentos-upgrade-skopeo-testscentos-upgrade-slirp4netnscentos-upgrade-slirp4netns-debuginfocentos-upgrade-slirp4netns-debugsourcecentos-upgrade-toolbox | Dec 18, 2019 | Sep 25, 2019 |
| Debian | debian-upgrade-golang-github-opencontainers-selinuxdebian-upgrade-runc | Feb 21, 2023 | Sep 25, 2019 | |
| Docker_ce | docker-ce-upgrade-latest | Nov 25, 2019 | Sep 25, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-app-emulation-runc | Mar 16, 2020 | Sep 25, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-buildahoracle-linux-upgrade-buildah-testsoracle-linux-upgrade-cockpit-podmanoracle-linux-upgrade-containernetworking-pluginsoracle-linux-upgrade-containers-commonoracle-linux-upgrade-container-selinuxoracle-linux-upgrade-fuse-overlayfsoracle-linux-upgrade-oci-systemd-hookoracle-linux-upgrade-oci-umountoracle-linux-upgrade-podmanoracle-linux-upgrade-podman-dockeroracle-linux-upgrade-podman-manpagesoracle-linux-upgrade-podman-remoteoracle-linux-upgrade-podman-testsoracle-linux-upgrade-python-podman-apioracle-linux-upgrade-runcoracle-linux-upgrade-skopeooracle-linux-upgrade-skopeo-testsoracle-linux-upgrade-slirp4netns | Oct 5, 2022 | Sep 22, 2019 |
| Redhat Openshift | linuxrpm-upgrade-runc | Nov 22, 2019 | Sep 25, 2019 | |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-buildahredhat-upgrade-buildah-debuginforedhat-upgrade-buildah-debugsourceredhat-upgrade-buildah-testsredhat-upgrade-buildah-tests-debuginforedhat-upgrade-cockpit-podmanredhat-upgrade-container-selinuxredhat-upgrade-containernetworking-pluginsredhat-upgrade-containernetworking-plugins-debuginforedhat-upgrade-containernetworking-plugins-debugsourceredhat-upgrade-containers-commonredhat-upgrade-fuse-overlayfsredhat-upgrade-fuse-overlayfs-debuginforedhat-upgrade-fuse-overlayfs-debugsourceredhat-upgrade-oci-systemd-hookredhat-upgrade-oci-systemd-hook-debuginforedhat-upgrade-oci-systemd-hook-debugsourceredhat-upgrade-oci-umountredhat-upgrade-oci-umount-debuginforedhat-upgrade-oci-umount-debugsourceredhat-upgrade-podmanredhat-upgrade-podman-debuginforedhat-upgrade-podman-debugsourceredhat-upgrade-podman-dockerredhat-upgrade-podman-manpagesredhat-upgrade-podman-remoteredhat-upgrade-podman-remote-debuginforedhat-upgrade-podman-testsredhat-upgrade-python-podman-apiredhat-upgrade-runcredhat-upgrade-runc-debuginforedhat-upgrade-runc-debugsourceredhat-upgrade-skopeoredhat-upgrade-skopeo-debuginforedhat-upgrade-skopeo-debugsourceredhat-upgrade-skopeo-testsredhat-upgrade-slirp4netnsredhat-upgrade-slirp4netns-debuginforedhat-upgrade-slirp4netns-debugsourceredhat-upgrade-toolbox | Dec 18, 2019 | Sep 25, 2019 | |
| Rocky_linux | rocky-upgrade-oci-systemd-hookrocky-upgrade-oci-systemd-hook-debuginforocky-upgrade-oci-systemd-hook-debugsourcerocky-upgrade-oci-umountrocky-upgrade-oci-umount-debuginforocky-upgrade-oci-umount-debugsource | Mar 12, 2024 | Sep 25, 2019 | |
| Suse | — | suse-upgrade-containerdsuse-upgrade-containerd-ctrsuse-upgrade-dockersuse-upgrade-docker-bash-completionsuse-upgrade-docker-libnetworksuse-upgrade-docker-runcsuse-upgrade-docker-testsuse-upgrade-docker-zsh-completionsuse-upgrade-golang-github-docker-libnetworksuse-upgrade-runc | Nov 1, 2019 | Sep 25, 2019 |
| Ubuntu | ubuntu-pro-upgrade-runcubuntu-upgrade-runc | Mar 10, 2020 | Sep 25, 2019 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Sep 25, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub