En resumen
- CVE-2023-28642 es una vulnerabilidad ALTO (CVSS 7.8) que afecta a github.com/opencontainers/runc, runc (linuxfoundation).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.34%, mayor que el 27.9% de las vulnerabilidades.
- Solución: actualizar a 1.1.5 o posterior.
Description
Impact
It was found that AppArmor, and potentially SELinux, can be bypassed when /proc inside the container is symlinked with a specific mount configuration.
Patches
Fixed in runc v1.1.5, by prohibiting symlinked /proc: https://github.com/opencontainers/runc/pull/3785
This PR fixes CVE-2023-27561 as well.
Workarounds
Avoid using an untrusted container image.
NVD description
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
Más vulnerabilidades de github.com/opencontainers/runc
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free