Описание
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| runc | fixed | 1.0.0~rc9+dfsg1-1 | package | |
| runc | no-dsa | stretch | package | |
| golang-github-opencontainers-selinux | fixed | 1.3.0-2 | package |
Примечания
https://github.com/opencontainers/runc/issues/2128
https://github.com/opencontainers/runc/commit/331692baa7afdf6c186f8667cb0e6362ea0802b3 (v1.0.0-rc9)
runc mitigation: https://github.com/opencontainers/runc/pull/2130 (v1.0.0-rc9)
golang-github-opencontainers-selinux mitigation: https://github.com/opencontainers/selinux/pull/59 (v1.3.1)
Связанные уязвимости
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork