CVE-2019-16884

Name
CVE-2019-16884
Description
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Exploit https://github.com/opencontainers/runc/issues/2128
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DGK6IV5JGVDXHOXEKJOJWKOVNZLT6MYR/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62OQ2P7K5YDZ5BRCH2Q6DHUJIHQD3QCD/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPK4JWP32BUIVDJ3YODZSOEVEW6BHQCF/
SUSE http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00073.html
SUSE http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00009.html
REDHAT https://access.redhat.com/errata/RHSA-2019:3940
REDHAT https://access.redhat.com/errata/RHSA-2019:4074
REDHAT https://access.redhat.com/errata/RHSA-2019:4269
SUSE http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00010.html
GENTOO https://security.gentoo.org/glsa/202003-21
UBUNTU https://usn.ubuntu.com/4297-1/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* runc >= 0.0.1 <= 0.1.1
cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:* runc == None == 1.0.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
runc edge-community 1.0.0_rc9-r0 None fixed
runc edge-community 1.0.0-r0 Jake Buchholz <tomalok@gmail.com> fixed
runc 3.22-community 1.0.0_rc9-r0 None fixed
runc 3.21-community 1.0.0_rc9-r0 None fixed
runc 3.20-community 1.0.0_rc9-r0 None fixed
runc 3.19-community 1.0.0_rc9-r0 None fixed
runc 3.18-community 1.0.0_rc9-r0 None fixed
runc 3.17-community 1.0.0_rc9-r0 None fixed
containerd edge-community 1.3.0-r0 None fixed
containerd 3.22-community 1.3.0-r0 None fixed
containerd 3.21-community 1.3.0-r0 None fixed
containerd 3.20-community 1.3.0-r0 None fixed
containerd 3.19-community 1.3.0-r0 None fixed
containerd 3.18-community 1.3.0-r0 None fixed
containerd 3.17-community 1.3.0-r0 None fixed