NetSight
IP …
high7.5

CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorr…

Impact

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

Affected products

VendorProductAffected versions
LinuxfoundationRunc
from 0.0.1 through 0.1.1
Version 1.0.0
DockerDocker
through 19.03.2
FedoraprojectFedora
Versions 29, 30, 31
OpensuseLeap
Versions 15.0, 15.1
RedhatOpenshift Container Platform
Versions 4.1, 4.2
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Eus
Versions 8.1, 8.2, 8.4
RedhatEnterprise Linux Server Aus
Versions 8.2, 8.4
RedhatEnterprise Linux Server Tus
Versions 8.2, 8.4
CanonicalUbuntu Linux
Versions 18.04, 19.10

Weakness classification

CWE-863

References