6.1Mittel

CVE-2023-28642AppArmor bypass with symlinked /proc in runc

opencontainers runc Veröffentlicht: 2023-03-29 21:15 (vor 3 Jahren)

Beschreibung

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

Schwachstellentyp (CWE): CWE-281

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
opencontainers	runc	< 1.1.5

Referenzen und Patches

CVSS-Score

6.1Mittel

Quelle: GitHub_M · CVSS 3.1

Angriffsvektor: Lokal
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Erforderlich
Geltungsbereich: Geändert
Vertraulichkeit: Niedrig
Integrität: Niedrig
Verfügbarkeit: Niedrig

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.34%

höher als 28 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2023-03-20
Veröffentlicht2023-03-29 21:15
Bei IP-DB eingegangen2026-10-24 23:53
Zuletzt aktualisiert2025-02-12 19:02

Vergeben von (CNA): GitHub_M

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — containerd / runc

4.6Mittel

CVE-2026-95838 vor 22 Tagen

containerd: Unpack DoS via repeated opaque whiteouts

containerd containerd

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory tr…

7.8Hoch

CVE-2026-95837 vor 22 Tagen

containerd CRI plugin: Checkpoint restore bypasses destination security context

containerd containerd

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination Containe…

6.9Mittel

CVE-2026-53493 vor 1 Monat

Containerd has image-pull DoS via crafted OCI index graph amplification

containerd containerd

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at …

6.8Mittel

CVE-2026-53495 vor 1 Monat

containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service

containerd containerd

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is u…

8.2Hoch

CVE-2026-53489 vor 4 Monaten

containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

containerd containerd

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on t…

8.4Hoch

CVE-2026-53492 vor 4 Monaten

containerd CRI checkpoint restore CDI annotation smuggling

containerd containerd

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. W…