CVE-2023-28642 AppArmor bypass with symlinked /proc in runc

2023-03-2918:15:48

CWE-281

GitHub_M

www.cve.org

apparmor

symlinked

/proc

runc

oci

bypass

symlink

mount

upgrade

container image

6.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

CNA Affected

[
  {
    "vendor": "opencontainers",
    "product": "runc",
    "versions": [
      {
        "version": "< 1.1.5",
        "status": "affected"
      }
    ]
  }
]