CVE-2023-28642: medium-severity vulnerability in opencontainers runc
AppArmor bypass with symlinked /proc in runc
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.3%
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected products
opencontainers · runcRelated CVEs — opencontainers runc
In the same product, most dangerous first.
CVE-2024-21626HIGHrunc container breakout through process.cwd trickery and leaked fdsEPSS 18.9%CVE-2021-43784MEDIUMOverflow in netlink bytemsg length field allows attacker to override netlink-based container configurationEPSS 1.8%CVE-2025-31133HIGHrunc container escape via "masked path" abuse due to mount race conditionsEPSS 1.2%CVE-2025-52565HIGHcontainer escape due to /dev/console mount and related racesEPSS 0.8%CVE-2025-52881HIGHrunc: LSM labels can be bypassed with malicious config using dummy procfs filesEPSS 0.8%CVE-2022-29162MEDIUMIncorrect Default Permissions in runcEPSS 0.4%