~ / search / GHSA-fgv8-vj5c-2ppq

GHSA-fgv8-vj5c-2ppq

Incorrect Authorization in runc

Source: GitHub Advisory Database (reviewed) High CVE-2019-16884

Packages

EcosystemPackageAffectedFixed in
Go github.com/opencontainers/runc < 1.0.0-rc8.0.20190930145003-cad42f6e0932 1.0.0-rc8.0.20190930145003-cad42f6e0932
Go github.com/opencontainers/selinux < 1.3.1-0.20190929122143-5215b1806f52 1.3.1-0.20190929122143-5215b1806f52

Details

As written in the advisory (Markdown source, shown as plain text).

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

References

External links from the advisory. They lead to third-party sites.