CVE-2019-16884: High severity linuxfoundation Runc vulnerability
Last updated 25 August 2025
Other sources
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/runcto a version that resolves this vulnerability.Fixed in 0:1.0.0-67.rc10.el7_8 - Upgrade
Upgrade
redhat/dockerto a version that resolves this vulnerability.Fixed in 2:1.13.1-161.git64e9980.el7_8 - Upgrade
Upgrade
redhat/runcto a version that resolves this vulnerability.Fixed in 0:1.0.0-62.rc8.rhaos4.1.git3cbe540.el8 - Upgrade
Upgrade
redhat/runcto a version that resolves this vulnerability.Fixed in 0:1.0.0-63.rc8.el8 - Upgrade
Upgrade
go/github.com/opencontainers/selinuxto a version that resolves this vulnerability.Fixed in 1.3.1-0.20190929122143-5215b1806f52 - Upgrade
Upgrade
go/github.com/opencontainers/runcto a version that resolves this vulnerability.Fixed in 1.0.0-rc8.0.20190930145003-cad42f6e0932 - Upgrade
Upgrade
debian/golang-github-opencontainers-selinuxto a version that resolves this vulnerability.Fixed in 1.8.0-1Fixed in 1.10.0+ds1-1Fixed in 1.11.1-1 - Upgrade
Upgrade
debian/runcto a version that resolves this vulnerability.Fixed in 1.0.0~rc93+ds1-5+deb11u5Fixed in 1.0.0~rc93+ds1-5+deb11u3Fixed in 1.1.5+ds1-1+deb12u1Fixed in 1.1.15+ds1-2Fixed in 1.3.3+ds1-2 - Upgrade
Upgrade
alpine/containerdto a version that resolves this vulnerability.Fixed in 1.3.0-r0 - Upgrade
Upgrade
alpine/runcto a version that resolves this vulnerability.Fixed in 1.0.0_rc9 - Upgrade
Upgrade
alpine/runcto a version that resolves this vulnerability.Fixed in 1.0.0_rc9-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-16884.
What is the severity rating of CVE-2019-16884?
The severity rating of CVE-2019-16884 is medium, with a severity value of 6.5.
What is the affected software for CVE-2019-16884?
The affected software for CVE-2019-16884 includes runc versions 1.0.0-rc8 and earlier, used in Docker versions through 19.03.2-ce.
How does CVE-2019-16884 allow AppArmor restriction bypass?
CVE-2019-16884 allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, allowing a malicious Docker image to mount over a /proc directory.
Are there any references available for CVE-2019-16884?
Yes, there are references available for CVE-2019-16884: [Reference 1](https://github.com/opencontainers/runc/issues/2128), [Reference 2](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DGK6IV5JGVDXHOXEKJOJWKOVNZLT6MYR/), [Reference 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62OQ2P7K5YDZ5BRCH2Q6DHUJIHQD3QCD/)