AppArmor bypass with symlinked /proc in runc
Summary
AppArmor bypass with symlinked /proc in runc
Original description
The description as published by the source.
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-28642 runc Fixed in: 1.0.0~rc93+ds1-5+deb11u5
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch github.com