En bref
- CVE-2023-28642 est une vulnérabilité ÉLEVÉE (CVSS 7.8) touchant github.com/opencontainers/runc, runc (linuxfoundation).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.34%, plus élevée que 27.9% des vulnérabilités.
- Correctif : mettre à jour vers 1.1.5 ou plus récent.
Description
Impact
It was found that AppArmor, and potentially SELinux, can be bypassed when /proc inside the container is symlinked with a specific mount configuration.
Patches
Fixed in runc v1.1.5, by prohibiting symlinked /proc: https://github.com/opencontainers/runc/pull/3785
This PR fixes CVE-2023-27561 as well.
Workarounds
Avoid using an untrusted container image.
NVD description
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
Autres vulnérabilités de github.com/opencontainers/runc
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free