CVE-2023-28642: runc AppArmor bypass with symlinked /proc
Summary
CVE-2023-28642: runc AppArmor bypass with symlinked /proc. Affects github.com/opencontainers/runc versions < 1.1.5. Fixed in 1.1.5. How to fix ↓
Also tracked for
- runc · Debian:11
The same CVE-2023-28642 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/opencontainers/runc, which is written in Go. runc is a command-line tool for spawning and running containers according to the Open Container Initiative (OCI) specification. It is widely used as the default runtime for Docker and other containerization platforms. The vulnerability in question allows for an AppArmor bypass when the /proc directory inside the container is symlinked with a specific mount configuration.
Vulnerability Detail
The vulnerability (CVE-2023-28642) arises due to a flaw in AppArmor and potentially SELinux, where they can be bypassed when the /proc directory inside the container is symlinked. This can lead to unauthorized access and privilege escalation within the container. The issue has a CVSS score of 6.1, indicating a moderate severity level. The vulnerability was fixed in runc version 1.1.5 by prohibiting symlinked /proc.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.5
This is the first release that contains the fix.
go get github.com/opencontainers/runc@v1.1.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is advised to avoid using untrusted container images. By ensuring that only trusted container images are used, the risk of exploiting this vulnerability can be mitigated.
Conclusion
In conclusion, the vulnerability (CVE-2023-28642) in runc allows for an AppArmor bypass when the /proc directory inside the container is symlinked. It is recommended to update runc to version 1.1.5 or later to fix the vulnerability. Avoiding untrusted container images can serve as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
runc is a command-line tool for spawning and running containers according to the Open Container Initiative (OCI) specification. It is widely used as the default runtime for Docker and other containerization platforms.
The vulnerability allows for an AppArmor bypass when the /proc directory inside the container is symlinked. This can lead to unauthorized access and privilege escalation within the container.
To fix the vulnerability, update runc to version 1.1.5 or later. This can be done by updating the package using the package manager or by manually downloading and installing the latest version from the official GitHub repository.
Yes, as a workaround, avoid using untrusted container images to mitigate the risk of exploiting this vulnerability.
The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
