AppArmor bypass with symlinked /proc in runc
Résumé
AppArmor bypass with symlinked /proc in runc
Description d'origine
La description telle que publiée par la source (souvent en anglais).
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-28642 runc Corrigé dans: 1.0.0~rc93+ds1-5+deb11u5
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch github.com