CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

Affected products

Alt Linux, Almalinux, Apparmor, Centos, Docker, Red Hat, Rocky Linux, Suse

Linuxfoundation Runc

≤ 0.1.1, 1.0.0

Fix

Available

CVSS 3.1

7.5 HIGH

EPSS

4.4% (90th percentile)

Weakness

CWE-863

NVD status

Modified

Published

2019-09-25

No exploit for CVE-2019-16884 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.