CVE-2019-16884: Authorization bypass in github.com/opencontainers/runc
Summary
CVE-2019-16884: Authorization bypass in github.com/opencontainers/runc. Affects github.com/opencontainers/runc versions < 1.0.0-rc8.0.20190930145003-cad42f6e0932. Fixed in 1.0.0-rc8.0.20190930145003-cad42f6e0932. How to fix ↓
Also tracked for
- golang-github-opencontainers-selinux · Debian:11
The same CVE-2019-16884 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/opencontainers/runc is a Go package that provides a lightweight container runtime for Linux. It is used by various containerization platforms and tools to create and manage containers. The package includes functionality for applying AppArmor profiles and managing mount targets. However, a vulnerability in the package allows for the bypass of AppArmor restrictions, potentially enabling a malicious image to mount volumes over critical system directories like /proc.
Vulnerability Detail
The vulnerability (CVE-2019-16884) arises from improper validation of mount targets in github.com/opencontainers/runc. This allows an attacker to exploit the package's functionality for applying AppArmor profiles and mount volumes in a way that bypasses the intended restrictions. By crafting a malicious image, an attacker can mount volumes over critical system directories, potentially leading to unauthorized access, data manipulation, or disruption of system functionality.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0-rc8.0.20190930145003-cad42f6e0932
This is the first release that contains the fix.
go get github.com/opencontainers/runc@v1.0.0-rc8.0.20190930145003-cad42f6e0932Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to update the package to the fixed version as soon as possible.
Conclusion
The vulnerability in github.com/opencontainers/runc allows for the bypass of AppArmor restrictions, potentially leading to unauthorized access, data manipulation, or disruption of system functionality. It is crucial to update the affected package to the fixed version (1.0.0-rc8.0.20190930145003-cad42f6e0932) or a later version to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
github.com/opencontainers/runc is a Go package that provides a lightweight container runtime for Linux. It is widely used in containerization platforms and tools.
This vulnerability allows for the bypass of AppArmor restrictions, potentially enabling a malicious image to mount volumes over critical system directories, leading to unauthorized access, data manipulation, or disruption of system functionality.
To fix this vulnerability, update the affected package (github.com/opencontainers/runc) to version 1.0.0-rc8.0.20190930145003-cad42f6e0932 or a later version.
No specific workarounds are provided for this vulnerability. It is crucial to update the package to the fixed version.
You can find more information about this vulnerability in the CVE-2019-16884 entry or on the Vulert website (https://vulert.com).
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
