runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
References
| Link | Resource |
|---|---|
| https://github.com/opencontainers/runc/pull/3785 | Patch |
| https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c | Patch Vendor Advisory |
Configurations
History
07 Nov 2023, 04:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image. |
06 Apr 2023, 17:45
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-59 | |
| First Time |
Linuxfoundation runc
Linuxfoundation |
|
| References | (MISC) https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c - Patch, Vendor Advisory | |
| References | (MISC) https://github.com/opencontainers/runc/pull/3785 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* |
29 Mar 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-29 19:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-28642
Mitre link : CVE-2023-28642
CVE.ORG link : CVE-2023-28642
JSON object : View
Products Affected
linuxfoundation
- runc