CVE-2019-16884: Incorrect Authorization in runc
Summary
CVE-2019-16884: Incorrect Authorization in runc. Affects github.com/opencontainers/runc versions < 1.0.0-rc8.0.20190930145003-cad42f6e0932. Fixed in 1.0.0-rc8.0.20190930145003-cad42f6e0932. How to fix ↓
Also tracked for
- golang-github-opencontainers-selinux · Debian:11
The same CVE-2019-16884 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/opencontainers/runc, which is written in Go. It is a command-line tool for spawning and running containers according to the Open Container Initiative (OCI) specification. Runc is widely used in container runtime environments, including Docker. It provides an interface for managing container processes, namespaces, and other container-related operations. However, a vulnerability has been discovered in runc that allows for incorrect authorization, potentially leading to AppArmor restriction bypass.
Vulnerability Detail
The vulnerability (CVE-2019-16884) arises from a flaw in the libcontainer/rootfs_linux.go file of runc. The issue occurs due to the incorrect checking of mount targets, allowing a malicious Docker image to mount over a /proc directory. This bypasses the AppArmor restriction and can lead to unauthorized access and potential compromise of the host system. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0-rc8.0.20190930145003-cad42f6e0932
This is the first release that contains the fix.
go get github.com/opencontainers/runc@v1.0.0-rc8.0.20190930145003-cad42f6e0932Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update the affected packages to the fixed versions.
Conclusion
In conclusion, the vulnerability (CVE-2019-16884) in github.com/opencontainers/runc allows for incorrect authorization and potential AppArmor restriction bypass. It is crucial to update the affected packages to the fixed versions mentioned above to mitigate the risk of unauthorized access and compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
Runc is a command-line tool for spawning and running containers according to the Open Container Initiative (OCI) specification. It is widely used in container runtime environments, including Docker.
The vulnerability allows for incorrect authorization, potentially leading to AppArmor restriction bypass. A malicious Docker image can mount over a /proc directory, compromising the host system.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, update the affected packages (github.com/opencontainers/runc and github.com/opencontainers/selinux) to the recommended versions.
No specific workaround is mentioned for this vulnerability. Updating the affected packages is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
