Read the docs
TI-2023-13160 Aliases CVE-2023-28642GHSA-g2j6-57v7-gm8c

AppArmor bypass with symlinked /proc in runc

Priority LOW 34CWE-281Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00343 27th percentileScored 2026-11-07
Fix Partial runc (opencontainers): 1.1.5github.com/opencontainers/runc (Go): 1.1.5Red Hat: 5 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstageruncbefore 1.1.51.1.5Patch availableCNA
—github.com/opencontainers/runc (Go)before 1.1.51.1.5Patch availableGHSA-g2j6-57v7-gm8c
  • runc Vendorbackstage Affected before 1.1.5 Fixed in 1.1.5 Patch available CNA
  • github.com/opencontainers/runc (Go) Vendor— Affected before 1.1.5 Fixed in 1.1.5 Patch available GHSA-g2j6-57v7-gm8c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*before 1.1.5Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions before 1.1.5 Vulnerable ·backstage

Remediation

  • Fix · CNA runc (opencontainers) Fixed in 1.1.5
  • Fix · GHSA-g2j6-57v7-gm8c github.com/opencontainers/runc (Go) Fixed in 1.1.5 Advisory →

Red Hat 5 advisories

  • RHSA-2024:0564 Released 2024-01-30 · Red Hat rating Moderate
    container-tools:3.0 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.src::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.x86_64::container-tools:3.0, buildah-tests-1.19.9-1.module+el8.4.0+21078+a96cfbf6.x86_64::container-tools:3.0 +40
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.ppc64le::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.src::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.x86_64::container-tools:3.0 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.src::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.x86_64::container-tools:3.0, buildah-tests-1.19.9-1.module+el8.4.0+21078+a96cfbf6.x86_64::container-tools:3.0 +40
  • RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
  • RHSA-2023:6938 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.s390x::container-tools:4.0 +47
Show 2 more Red Hat advisories
  • RHSA-2023:6380 Released 2023-11-07 · Red Hat rating Moderate
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.9-1.el9
  • RHSA-2023:1326 Released 2023-05-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.0 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:6938, RHSA-2023:6939
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:6380
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:0564
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:0564
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:0564
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:1326
Not affected: 2 products
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28642
  2. 2026-10-03 Alias added: GHSA-g2j6-57v7-gm8c

References

Patch 2

Advisory 1

Other 2

  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2024-14351 runc container breakout through process.cwd trickery and leaked fds CVSS 3.1HIGH 8.6
  • TI-2021-10869 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. CVSS 3.1HIGH 8.5
  • TI-2019-12591 runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows… CVSS 3.1HIGH 7.5
  • TI-2025-32660 container escape due to /dev/console mount and related races CVSS 4.0HIGH 8.4
  • TI-2025-22394 runc container escape via "masked path" abuse due to mount race conditions CVSS 4.0HIGH 7.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences