GitHub Advisoryadvisory · Go

GHSA-fgv8-vj5c-2ppq Incorrect Authorization in runc

HIGH Published 2022-02-22 Modified 2024-05-20 Official page ↗
Aliases
CVE-2019-16884
Ecosystem
Go
Packages
github.com/opencontainers/runc, github.com/opencontainers/selinux
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-863
Reviewed
2022-02-22

Affected packages

• Go github.com/opencontainers/runc: < 1.0.0-rc8.0.20190930145003-cad42f6e0932 → fixed in 1.0.0-rc8.0.20190930145003-cad42f6e0932 • Go github.com/opencontainers/selinux: < 1.3.1-0.20190929122143-5215b1806f52 → fixed in 1.3.1-0.20190929122143-5215b1806f52

Description

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

Related

Alias · CVE (1)

  • CVE-2019-16884 runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References