PT-2019-5667 · Docker+8 · Docker+9

Adam Iwaniuk

·

Published

2016-08-03

·

Updated

2024-06-15

·

CVE-2019-16884

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:C/A:N
Name of the Vulnerable Software and Affected Versions runc versions through 1.0.0-rc8 Docker versions through 19.03.2-ce
Description The issue is related to a component of AppArmor in the runc tool for running isolated containers, which is associated with shortcomings in the authorization mechanism. This allows a remote attacker to mount a malicious Docker image in the /proc directory. The problem arises due to improper validation of mount targets, enabling a malicious image to mount volumes over sensitive directories like /proc.
Recommendations For runc versions through 1.0.0-rc8, consider disabling the libcontainer/rootfs linux.go function until a patch is available to prevent the bypassing of AppArmor restrictions. For Docker versions through 19.03.2-ce, restrict access to the libcontainer/rootfs linux.go module to minimize the risk of exploitation. As a temporary workaround, avoid using the /proc directory in the affected API endpoints until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2019:4269
ALT-PU-2016-1817
ALT-PU-2019-2850
ALT-PU-2020-1253
ALT-PU-2020-2984
ALT-PU-2020-2985
ALT-PU-2020-3026
ALT-PU-2020-3027
BDU:2020-04920
CESA-2019_4269
CVE-2019-16884
DLA-3322-1
DLA-3369-1
GHSA-FGV8-VJ5C-2PPQ
GO-2021-0085
MGASA-2020-0050
OPENSUSE-SU-2019:2418-1
OPENSUSE-SU-2019:2434-1
OPENSUSE-SU-2019_2418-1
OPENSUSE-SU-2019_2434-1
OPENSUSE-SU-2020:0045-1
OPENSUSE-SU-2020_0045-1
OPENSUSE-SU-2024:11358-1
RHSA-2019:3940
RHSA-2019:4074
RHSA-2019:4269
RHSA-2019_4269
RHSA-2020:1234
RLSA-2019:4269
SUSE-SU-2019:2786-1
SUSE-SU-2019:2787-1
SUSE-SU-2019:2810-1
SUSE-SU-2019_2786-1
SUSE-SU-2019_2787-1
SUSE-SU-2019_2810-1
SUSE-SU-2020:0035-1
SUSE-SU-2020:0065-1
SUSE-SU-2020_0035-1
SUSE-SU-2020_0065-1
SUSE-SU-2021:1458-1
USN-4297-1
USN-4867-1

Affected Products

Alt Linux
Almalinux
Apparmor
Centos
Docker
Red Hat
Rocky Linux
Suse
Ubuntu
Runc