CVE-2019-16884
25.09.2019, 18:15
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.Enginsight
| Vendor | Product | Version |
|---|---|---|
| linuxfoundation | runc | 0.0.1 ≤ 𝑥 ≤ 0.1.1 |
| linuxfoundation | runc | 1.0.0:rc1 |
| linuxfoundation | runc | 1.0.0:rc2 |
| linuxfoundation | runc | 1.0.0:rc3 |
| linuxfoundation | runc | 1.0.0:rc4 |
| linuxfoundation | runc | 1.0.0:rc5 |
| linuxfoundation | runc | 1.0.0:rc6 |
| linuxfoundation | runc | 1.0.0:rc7 |
| linuxfoundation | runc | 1.0.0:rc8 |
| docker | docker | 𝑥 ≤ 19.03.2 |
| opensuse | leap | 15.0 |
| opensuse | leap | 15.1 |
| redhat | openshift_container_platform | 4.1 |
| redhat | openshift_container_platform | 4.2 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux_eus | 8.1 |
| redhat | enterprise_linux_eus | 8.2 |
| redhat | enterprise_linux_eus | 8.4 |
| redhat | enterprise_linux_server_aus | 8.2 |
| redhat | enterprise_linux_server_aus | 8.4 |
| redhat | enterprise_linux_server_tus | 8.2 |
| redhat | enterprise_linux_server_tus | 8.4 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.10 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| golang-github-opencontainers-selinux |
| ||||||||||||||
| runc |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| runc |
|
References