In breve
- CVE-2023-28642 è una vulnerabilità ALTO (CVSS 7.8) che riguarda github.com/opencontainers/runc, runc (linuxfoundation).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.34%, superiore al 27.9% delle vulnerabilità.
- Correzione: aggiornare a 1.1.5 o successiva.
Description
Impact
It was found that AppArmor, and potentially SELinux, can be bypassed when /proc inside the container is symlinked with a specific mount configuration.
Patches
Fixed in runc v1.1.5, by prohibiting symlinked /proc: https://github.com/opencontainers/runc/pull/3785
This PR fixes CVE-2023-27561 as well.
Workarounds
Avoid using an untrusted container image.
NVD description
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
Altre vulnerabilità di github.com/opencontainers/runc
Vedi tutto →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free