CVE-2023-28642

MEDIUM6.1

AppArmor bypass with symlinked /proc in runc

Published Mar 29, 2023

Modified 11 months ago

No fix available

Details

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

References

WEBhttps://github.com/opencontainers/runc/pull/3785 WEBhttps://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c WEBhttps://security.netapp.com/advisory/ntap-20241206-0005/ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2023-28642

CVSS Analysis

CVSS v3.1

6.1

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

LowA:L

6.1/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness Type (CWE)

Other

CWE-281

Ecosystems

Timeline

PublishedMar 29, 2023

ModifiedFeb 12, 2025