Vulnerable Library - github.com/opencontainers/runc-v1.0.3

CLI tool for spawning and running containers according to the OCI specification

Library home page: https://proxy.golang.org/github.com/opencontainers/runc/@v/v1.0.3.zip

Dependency Hierarchy:

• github.com/docker/docker-v20.10.3-0.20220207145910-4b3471ddc064+incompatible (Root Library)
  • ❌ github.com/opencontainers/runc-v1.0.3 (Vulnerable Library)

Found in HEAD commit: b3ac62d12e3d43994ff7ad836e34da801ed665fb

Found in base branch: master

Vulnerability Details

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

Publish Date: 2023-03-29

URL: CVE-2023-28642

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-g2j6-57v7-gm8c

Release Date: 2023-03-29

Fix Resolution: v1.1.5