runc AppArmor bypass with symlinked /proc
### Impact
It was found that AppArmor, and potentially SELinux, can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration.
### Patches
Fixed in runc v1.1.5, by prohibiting symlinked `/proc`: https://github.com/opencontainers/runc/pull/3785
This PR fixes CVE-2023-27561 as well.
### Workarounds
Avoid using an untrusted container image.
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
1
cwe_id
59
name
Improper Link Resolution Before File Access ('Link Following')
description
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
2
cwe_id
305
name
Authentication Bypass by Primary Weakness
description
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.