REDHAT-BUG-1757214
First published: Mon Sep 30 2019(Updated: )
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory. References: <a href="https://github.com/opencontainers/runc/issues/2128">https://github.com/opencontainers/runc/issues/2128</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenContainers runc | >=1.0.0-rc8<=1.0.0-rc8 | |
| Docker | <=19.03.2-ce |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/opencontainers/runc/issues/2128
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1757290
- https://github.com/opencontainers/runc/issues/2128#issuecomment-535478352
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1760989
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1760990
- https://github.com/projectatomic/runc/pull/28
- https://github.com/opencontainers/runc/pull/2129
- https://access.redhat.com/errata/RHSA-2019:3940
- https://access.redhat.com/security/cve/cve-2019-16884
- https://access.redhat.com/errata/RHSA-2019:4074
- https://access.redhat.com/errata/RHSA-2019:4269
- https://access.redhat.com/errata/RHSA-2020:1234
- https://access.redhat.com/errata/RHBA-2020:1232
- https://bugzilla.redhat.com/show_bug.cgi?id=1757214
Frequently Asked Questions
What is the severity of REDHAT-BUG-1757214?
The severity of REDHAT-BUG-1757214 is typically considered high due to the potential for AppArmor restriction bypass.
How do I fix REDHAT-BUG-1757214?
To fix REDHAT-BUG-1757214, update runc to a version later than 1.0.0-rc8 and Docker to a version beyond 19.03.2-ce.
What products are affected by REDHAT-BUG-1757214?
The vulnerability REDHAT-BUG-1757214 affects OpenContainers runc versions up to 1.0.0-rc8 and Docker versions up to 19.03.2-ce.
Does REDHAT-BUG-1757214 affect production systems?
Yes, REDHAT-BUG-1757214 can impact production systems using the affected versions of runc and Docker if exploited.
What could an attacker do with REDHAT-BUG-1757214?
An attacker could leverage REDHAT-BUG-1757214 to bypass AppArmor restrictions and potentially gain unauthorized access to the host system through the Docker container.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-16884
- agent/source
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/opencontainers
- canonical/opencontainers runc
- vendor/docker
- canonical/docker