{"id":"CVE-2023-28642","published":"2023-03-29T18:15:48Z","modified":"2025-02-12T16:02:53Z","title":"AppArmor bypass with symlinked /proc in runc","vendor":"opencontainers","product":"runc","tier":"tail","description":{"text":"runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.\n\n","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00343,"percentile":0.27731,"provenance":"source"},"cwes":[{"id":"CWE-281","name":"Improper Preservation of Permissions"}],"references":[{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/opencontainers/runc/pull/3785","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20241206-0005/","tags":[]}],"priority":{"score":9.8,"factors":[{"name":"EPSS percentile","points":5.55},{"name":"CVSS severity","points":4.27}]},"vendorSlug":"opencontainers","affectedVersions":[{"vendor":"opencontainers","product":"runc","versions":["< 1.1.5"]}],"affected":[{"ecosystem":"Go","package":"github.com/opencontainers/runc","vulnerableRanges":["<1.1.5"],"patched":["1.1.5"],"from":["GHSA-g2j6-57v7-gm8c","GO-2023-1683"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1007","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-29162","published":"2022-05-17","fixed":"1.1.2","kev":false,"link":{"from":"CVE-2022-29162","to":"CVE-2023-28642","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.1.2","toFixed":"1.1.5","daysApart":316}]}},{"cve":"CVE-2023-25809","published":"2023-03-29","fixed":"1.1.5","kev":false},{"cve":"CVE-2023-27561","published":"2023-03-03","fixed":"1.1.5","kev":false},{"cve":"CVE-2023-28642","published":"2023-03-29","fixed":"1.1.5","kev":false},{"cve":"CVE-2024-21626","published":"2024-01-31","fixed":"1.1.12","kev":false},{"cve":"CVE-2024-45310","published":"2024-09-03","fixed":"1.2.0-rc.3","kev":false},{"cve":"CVE-2025-31133","published":"2025-11-06","fixed":"1.4.0-rc.3","kev":false}],"package":"Go:github.com/opencontainers/runc"}}