要点
- CVE-2023-28642 是影响 github.com/opencontainers/runc, runc (linuxfoundation) 的高危 (CVSS 7.8)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.34%，高于 27.9% 的漏洞。
- 修复：升级到 1.1.5 或更高版本。
Description
Impact
It was found that AppArmor, and potentially SELinux, can be bypassed when /proc inside the container is symlinked with a specific mount configuration.
Patches
Fixed in runc v1.1.5, by prohibiting symlinked /proc: https://github.com/opencontainers/runc/pull/3785
This PR fixes CVE-2023-27561 as well.
Workarounds
Avoid using an untrusted container image.
NVD description
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
github.com/opencontainers/runc 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free