runc AppArmor bypass with symlinked /proc

GHSA-g2j6-57v7-gm8c · CVE-2023-28642 · GO-2023-1683

Published Mar 30, 2023 · Modified Feb 4, 2026

Description

Impact

It was found that AppArmor, and potentially SELinux, can be bypassed when /proc inside the container is symlinked with a specific mount configuration.

Patches

Fixed in runc v1.1.5, by prohibiting symlinked /proc: https://github.com/opencontainers/runc/pull/3785

This PR fixes CVE-2023-27561 as well.

Workarounds

Avoid using an untrusted container image.

References

WEB https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-28642
WEB https://github.com/opencontainers/runc/pull/3785
PACKAGE https://github.com/opencontainers/runc
WEB https://security.netapp.com/advisory/ntap-20241206-0005

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes