요약
- CVE-2023-28642은(는) github.com/opencontainers/runc, runc (linuxfoundation)에 영향을 주는 높음 (CVSS 7.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.34%, 전체 취약점의 27.9%보다 높음.
- 조치: 1.1.5 이상으로 업데이트하세요.
Description
Impact
It was found that AppArmor, and potentially SELinux, can be bypassed when /proc inside the container is symlinked with a specific mount configuration.
Patches
Fixed in runc v1.1.5, by prohibiting symlinked /proc: https://github.com/opencontainers/runc/pull/3785
This PR fixes CVE-2023-27561 as well.
Workarounds
Avoid using an untrusted container image.
NVD description
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
github.com/opencontainers/runc의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free