CVE-2023-28642: AppArmor bypass with symlinked /proc in runc
Impact It was found that AppArmor, and potentially SELinux, can be bypassed when /proc inside the container is symlinked with a specific mount configuration.
Patches Fixed in runc v1.1.5, by prohibiting symlinked /proc: https://github.com/opencontainers/runc/pull/3785
This PR fixes CVE-2023-27561 as well.
Workarounds Avoid using an untrusted container image.
Other sources
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration.
References:
https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c https://github.com/opencontainers/runc/pull/3785
— Red Hat
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/runcto a version that resolves this vulnerability.Fixed in 1.1.5 - Upgrade
Upgrade
go/github.com/opencontainers/runcto a version that resolves this vulnerability.Fixed in 1.1.5 - Upgrade
Upgrade
debian/runcto a version that resolves this vulnerability.Fixed in 1.0.0~rc93+ds1-5+deb11u5Fixed in 1.1.5+ds1-1+deb12u1Fixed in 1.1.15+ds1-2 - Upgrade
Upgrade
alpine/runcto a version that resolves this vulnerability.Fixed in 1.1.5-r0 - Upgrade
Upgrade
alpine/runcto a version that resolves this vulnerability.Fixed in 1.1.4-r0 - Upgrade
Upgrade
opencontainers/runcto a version that resolves this vulnerability.Fixed in 1.1.5 - Compensating control
Avoid using an untrusted container image if unable to upgrade runc.
Event History
Frequently Asked Questions
What is CVE-2023-28642?
CVE-2023-28642 is a vulnerability found in the runc CLI tool, which allows bypassing of AppArmor security when `/proc` inside a container is symlinked with a specific mount configuration.
What is the severity of CVE-2023-28642?
CVE-2023-28642 has a severity rating of medium with a severity value of 4.
How can the CVE-2023-28642 vulnerability be fixed?
The CVE-2023-28642 vulnerability can be fixed by upgrading to runc version 1.1.5 or higher.
Where can I find more information about CVE-2023-28642?
You can find more information about CVE-2023-28642 on the official GitHub page of runc and the Open Containers Initiative (OCI) security advisories.
What is the affected software for CVE-2023-28642?
The affected software for CVE-2023-28642 includes runc version 1.0.0~ up to but excluding 1.1.5.