CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

Link	Resource
https://github.com/opencontainers/runc/issues/2128	Exploit Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DGK6IV5JGVDXHOXEKJOJWKOVNZLT6MYR/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62OQ2P7K5YDZ5BRCH2Q6DHUJIHQD3QCD/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPK4JWP32BUIVDJ3YODZSOEVEW6BHQCF/	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00073.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00009.html	Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3940	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4074	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4269	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00010.html	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202003-21	Third Party Advisory
https://usn.ubuntu.com/4297-1/	Third Party Advisory
https://security.netapp.com/advisory/ntap-20220221-0004/	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00016.html

Configuration 1

cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:* cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:* cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:* cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:* cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:* cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:* cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:* cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:* cpe:2.3:a:docker:docker:*:*:*:*:community:*:*:* cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

---

Published : 2019-09-25 06:15

Updated : 2023-02-18 07:15

---

NVD link : CVE-2019-16884

Mitre link : CVE-2019-16884

Enterprise Linux Eus

Redhat

CWE-863