Login Request a demo
High severity · published Mar 29, 2023
CVE-2023-28642
runc is a CLI tool for spawning and running containers according to the OCI specification
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
Runc · Linuxfoundation
before 1.1.5 · source: NVD
Affected product
RU
Runc
Linuxfoundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28642
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28642
Patch
https://github.com/opencontainers/runc/pull/3785
Patch
https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
security.netapp.com
https://security.netapp.com/advisory/ntap-20241206-0005/
More from Runc
8.6
CVE-2024-21626
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification
8.6
CVE-2019-5736
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by…
8.5
CVE-2021-30465
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal
7.8
CVE-2025-31133
runc is a CLI tool for spawning and running containers according to the OCI specification
7.8
CVE-2022-29162
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification