CVE-2023-28642: AppArmor bypass with symlinked /proc in runc
Impact It was found that AppArmor, and potentially SELinux, can be bypassed when /proc inside the container is symlinked with a specific mount configuration.
Patches Fixed in runc v1.1.5, by prohibiting symlinked /proc: https://github.com/opencontainers/runc/pull/3785
This PR fixes CVE-2023-27561 as well.
Workarounds Avoid using an untrusted container image.
Other sources
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration.
References:
https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c https://github.com/opencontainers/runc/pull/3785
— Red Hat
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-28642?
CVE-2023-28642 is a vulnerability found in the runc CLI tool, which allows bypassing of AppArmor security when `/proc` inside a container is symlinked with a specific mount configuration.
What is the severity of CVE-2023-28642?
CVE-2023-28642 has a severity rating of medium with a severity value of 4.
How can the CVE-2023-28642 vulnerability be fixed?
The CVE-2023-28642 vulnerability can be fixed by upgrading to runc version 1.1.5 or higher.
Where can I find more information about CVE-2023-28642?
You can find more information about CVE-2023-28642 on the official GitHub page of runc and the Open Containers Initiative (OCI) security advisories.
What is the affected software for CVE-2023-28642?
The affected software for CVE-2023-28642 includes runc version 1.0.0~ up to but excluding 1.1.5.