CVE-2023-28642: Improper Link Resolution Before File Access ('Link Following')

March 29, 2023 (updated November 9, 2023)

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

References

github.com/opencontainers/runc/pull/3785
github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
nvd.nist.gov/vuln/detail/CVE-2023-28642

Code Behaviors & Features

Detect and mitigate CVE-2023-28642 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →