CVE-2019-16884

HIGH7.5EPSS 0.32%

Incorrect Authorization in runc

Published: 2/22/2022Modified: 2/4/2026

Also known as:GHSA-fgv8-vj5c-2ppqCGA-x28q-hfg9-3p5xDEBIAN-CVE-2019-16884DLA-3322-1GO-2021-0085

Description

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

Affected packages (8)

Debian/golang-github-opencontainers-selinuxfrom 0, < 1.3.0-2
Debian/golang-github-opencontainers-selinuxfrom 0, < 1.0.0~rc1+git20170621.5.4a2974b-1+deb10u1
Debian/runcfrom 0, < 1.0.0~rc9+dfsg1-1
Debian/runcfrom 0, < 1.0.0~rc6+dfsg1-3+deb10u2
Go/github.com/opencontainers/runcfrom 0, < 1.0.0-rc8.0.20190930145003-cad42f6e0932
Go/github.com/opencontainers/runcfrom 0, < 1.0.0-rc8.0.20190930145003-cad42f6e0932
Go/github.com/opencontainers/selinuxfrom 0, < 1.3.1-0.20190929122143-5215b1806f52
Go/github.com/opencontainers/selinuxfrom 0, < 1.3.1-0.20190929122143-5215b1806f52

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

Affected packages (8)

CVSS scores

References (23)