CVE-2019-16884 is a high-severity vulnerability in runc versions through 1.0.0-rc8, affecting products like Docker through 19.03.2-ce, Canonical, Fedora, and Red Hat. It allows an AppArmor restriction bypass due to improper mount target checks, enabling a malicious Docker image to mount over a /proc directory. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to high integrity impacts. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered significant community discussion and media coverage, indicating awareness among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.0.1, <= 0.1.1CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* | ||
1.0.0CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:* | ||
1.0.0CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:* | ||
1.0.0CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:* | ||
1.0.0CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Incorrect Authorization in runc
Feb 22, 2022CVE-2019-16884
Jul 13, 2021runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc
Sep 22, 2019runc through 1.0.0-rc8 as used in Docker through 19.03.2-ce and other products allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets and thus a malicious Docker image can mount over a /proc directory.
Sep 10, 2019