CVE Feed

    Dashboard / CVE / CVE-2023-28642

    CVE-2023-28642

    runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

    Published:Mar 29, 2023
    Last Modified:Feb 12, 2025
    EPS:Mar 29, 2023
    EPSS Score:0.00011
    CVSS Score:6.1

    Affected Products

    Vendor
    Linuxfoundation
    Product
    Runc
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Openshift
    Vendor
    Redhat
    Product
    Rhel Aus
    Vendor
    Redhat
    Product
    Rhel E4s
    Vendor
    Redhat
    Product
    Rhel Tus

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-52881 (CVSS 7.3) — runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, …
    CVE-2025-52565 (CVSS 8.4) — runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 …
    CVE-2025-31133 (CVSS 7.3) — runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 a…
    CVE-2024-45310 (CVSS 3.6) — runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and ear…
    CVE-2024-21626 (CVSS 8.6) — runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.…
    CVE-2023-25809 (CVSS 5) — runc is a CLI tool for spawning and running containers according to the OCI specification. In affected version…
    CVE-2023-27561 (CVSS 7) — runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/r…
    CVE-2022-29162 (CVSS 5.9) — runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was …
    CVE-2022-24769 (CVSS 5.9) — Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was…
    CVE-2021-43784 (CVSS 6) — runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, n…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High