Search for vulnerabilities
Vulnerability details: VCID-6j4q-p114-aaae
Vulnerability ID VCID-6j4q-p114-aaae
Aliases CVE-2023-28642
GHSA-g2j6-57v7-gm8c
Summary runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
Status Published
Exploitability 0.5
Weighted Severity 7.0
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-305 Authentication Bypass by Primary Weakness
CWE-281 Improper Preservation of Permissions
System Score Found at
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28642.json
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 0.00106 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2023-28642
cvssv3.1 6.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 3.6 https://github.com/opencontainers/runc
cvssv3.1 6.1 https://github.com/opencontainers/runc
generic_textual LOW https://github.com/opencontainers/runc
generic_textual MODERATE https://github.com/opencontainers/runc
cvssv3.1 6.1 https://github.com/opencontainers/runc/pull/3785
generic_textual MODERATE https://github.com/opencontainers/runc/pull/3785
ssvc Track https://github.com/opencontainers/runc/pull/3785
cvssv3.1 6.1 https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
generic_textual MODERATE https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
ssvc Track https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
cvssv3 7.8 https://nvd.nist.gov/vuln/detail/CVE-2023-28642
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2023-28642
cvssv3.1 7.8 https://nvd.nist.gov/vuln/detail/CVE-2023-28642
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-28642
cvssv3.1 6.1 https://security.netapp.com/advisory/ntap-20241206-0005
generic_textual MODERATE https://security.netapp.com/advisory/ntap-20241206-0005
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28642.json
https://api.first.org/data/v1/epss?cve=CVE-2023-28642
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/opencontainers/runc
https://github.com/opencontainers/runc/pull/3785
https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
https://security.netapp.com/advisory/ntap-20241206-0005
https://security.netapp.com/advisory/ntap-20241206-0005/
2182883 https://bugzilla.redhat.com/show_bug.cgi?id=2182883
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*
CVE-2023-28642 https://nvd.nist.gov/vuln/detail/CVE-2023-28642
GLSA-202408-25 https://security.gentoo.org/glsa/202408-25
RHSA-2023:1326 https://access.redhat.com/errata/RHSA-2023:1326
RHSA-2023:6380 https://access.redhat.com/errata/RHSA-2023:6380
RHSA-2023:6938 https://access.redhat.com/errata/RHSA-2023:6938
RHSA-2023:6939 https://access.redhat.com/errata/RHSA-2023:6939
RHSA-2024:0564 https://access.redhat.com/errata/RHSA-2024:0564
USN-6088-1 https://usn.ubuntu.com/6088-1/
USN-6088-2 https://usn.ubuntu.com/6088-2/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-28642.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N Found at https://github.com/opencontainers/runc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://github.com/opencontainers/runc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://github.com/opencontainers/runc/pull/3785
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T16:02:47Z/ Found at https://github.com/opencontainers/runc/pull/3785
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T16:02:47Z/ Found at https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-28642
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2023-28642
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-28642
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://security.netapp.com/advisory/ntap-20241206-0005
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.00871
EPSS Score 0.00011
Published At May 7, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.