AppArmor Restriction Bypass in runc and golang-github-opencontainers-selinux
Summary
CVE-2019-16884: runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image... Affects golang-github-opencontainers-selinux across 15 version ranges.
< 1.3.0-2
< 2e7cfe036e2c6dc51ccca6eb7fa3ee6b63976dcd
< 04f275d4601ca7e5ff9460cec7f65e8dd15443ec
< 4fc53a81fb7c994640722ac585fa9ca548971871
< 6a30dfca03664a0b6bf0646a7d389ee7d0318e6e
< 69ae5da6afdcaaf38285a10b36f362e41cb298d6
< 75f8da7c889acc4509a0cf6f0d3a8f9584778375
< 425e105d5a03fabd737a126ad93d62a9eeede87f
< 8293a0d53350b9ebb584988efe3096c313a13ad4
< 64291f7db5bd8150a74ad2036f1037e6a0428df2
>= 2598484b97994f61781e4f40b9782e0809e4e2c2, <= baf6536d6259209c3edfa2b22237af82942d3dfa
< b953c0d234bc72e8489d3bf51a276c5c4ec85345
< c91b5bea4830a57eac7882d7455d59518cdf70ec
< ccb5efd37fb7c86364786e9137e22948751de7ed
< ed20165a37b40ff1cfbe55e218344c5e89f30ee2
Fixed in 1.3.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a lightweight container runtime that is used by Docker and other container management tools to create and manage containers. It is responsible for running containers according to the specifications defined in the Open Container Initiative (OCI). The golang-github-opencontainers-selinux package provides SELinux support for container runtimes. This vulnerability affects these packages by allowing a malicious Docker image to bypass AppArmor restrictions, potentially leading to unauthorized access to sensitive system directories.
Vulnerability Detail
The vulnerability, identified as CVE-2019-16884, arises from an incorrect check of mount targets in the libcontainer/rootfs_linux.go file of runc. This flaw allows a malicious Docker image to mount over a /proc directory, which could lead to privilege escalation or unauthorized access to sensitive information within the container environment. The issue is particularly concerning as it can be exploited without requiring elevated privileges, making it a significant risk for systems using affected versions of runc and golang-github-opencontainers-selinux.
How To Fix
Minimum fixed version
1.3.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade golang-github-opencontainers-selinuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to restrict the use of Docker images that are not trusted and to monitor container activities closely. Additionally, consider implementing stricter AppArmor profiles to limit the potential impact of this vulnerability until a fix can be applied.
Conclusion
CVE-2019-16884 is a significant vulnerability affecting runc and golang-github-opencontainers-selinux, allowing AppArmor restriction bypass. Users are strongly advised to upgrade to the latest versions of these packages to mitigate the risk. In the meantime, implementing workarounds can help reduce exposure to potential attacks.
See every vulnerability recorded for golang-github-opencontainers-selinux →
FAQ
CVE-2019-16884 is a vulnerability in runc and golang-github-opencontainers-selinux that allows AppArmor restriction bypass, enabling a malicious Docker image to mount over a /proc directory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential risks include privilege escalation and unauthorized access to sensitive system information, which can compromise the security of the host system.
If immediate upgrading is not possible, restrict the use of untrusted Docker images and implement stricter AppArmor profiles as a temporary measure.
The CVSS score of CVE-2019-16884 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-opencontainers-selinux.
