CVE-2019-16884
Fixed in a distro release EPSS 4%
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Products: linuxfoundation runc, docker, fedoraproject fedora, opensuse leap, redhat openshift_container_platform, redhat enterprise_linux, redhat enterprise_linux_eus, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus, canonical ubuntu_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/opencontainers/runc | 1.0.0-rc8.0.20190930145003-cad42f6e0932 |
| Go | github.com/opencontainers/selinux | 1.3.1-0.20190929122143-5215b1806f52 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | oci-systemd-hook | 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082 |
| AlmaLinux 8 | oci-systemd-hook | 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43 |
| AlmaLinux 8 | oci-systemd-hook | 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43 |
| AlmaLinux 8 | oci-umount | 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082 |
| AlmaLinux 8 | oci-umount | 2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43 |
| AlmaLinux 8 | oci-umount | 2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43 |
| Chainguard | py3-docker | 0 |
| Chainguard | py3.10-docker | 0 |
| Chainguard | py3.11-docker | 0 |
| Chainguard | py3.12-docker | 0 |
| Chainguard | py3.13-docker | 0 |
| Chainguard | runc | 0 |
| Chainguard | runc-doc | 0 |
| Debian 10 | golang-github-opencontainers-selinux | 1.0.0~rc1+git20170621.5.4a2974b-1+deb10u1 |
| Debian 10 | runc | 1.0.0~rc6+dfsg1-3+deb10u2 |
| Debian 12 | golang-github-opencontainers-selinux | 1.3.0-2 |
| Debian 12 | runc | 1.0.0~rc9+dfsg1-1 |
| Debian 13 | golang-github-opencontainers-selinux | 1.3.0-2 |
| Debian 13 | runc | 1.0.0~rc9+dfsg1-1 |
| Debian 14 | golang-github-opencontainers-selinux | 1.3.0-2 |
| Debian 14 | runc | 1.0.0~rc9+dfsg1-1 |
| Red Hat Enterprise Linux 8 | buildah | 0:1.9.0-5.module+el8.1.0+4240+893c1ab8 |
| Red Hat Enterprise Linux 8 | buildah-debuginfo | 0:1.9.0-5.module+el8.1.0+4240+893c1ab8 |
| Red Hat Enterprise Linux 8 | buildah-debugsource | 0:1.9.0-5.module+el8.1.0+4240+893c1ab8 |
| Red Hat Enterprise Linux 8 | buildah-tests | 0:1.9.0-5.module+el8.1.0+4240+893c1ab8 |
| Red Hat Enterprise Linux 8 | buildah-tests-debuginfo | 0:1.9.0-5.module+el8.1.0+4240+893c1ab8 |
| Red Hat Enterprise Linux 8 | cockpit-podman | 0:4-1.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | container-selinux | 2:2.123.0-2.module+el8.1.0+4900+9d7326b8 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins | 0:0.8.1-3.module+el8.1.0+4881+045289ee |
| Red Hat Enterprise Linux 8 | containernetworking-plugins-debuginfo | 0:0.8.1-3.module+el8.1.0+4881+045289ee |
| Red Hat Enterprise Linux 8 | containernetworking-plugins-debugsource | 0:0.8.1-3.module+el8.1.0+4881+045289ee |
| Red Hat Enterprise Linux 8 | containers-common | 1:0.1.37-6.module+el8.1.0+4876+e678a192 |
| Red Hat Enterprise Linux 8 | fuse-overlayfs | 0:0.4.1-1.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | fuse-overlayfs-debuginfo | 0:0.4.1-1.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | fuse-overlayfs-debugsource | 0:0.4.1-1.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-systemd-hook | 1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-systemd-hook-debuginfo | 1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-systemd-hook-debugsource | 1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-umount | 2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-umount-debuginfo | 2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-umount-debugsource | 2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | podman | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-debuginfo | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-debugsource | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-docker | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-manpages | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-remote | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-remote-debuginfo | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-tests | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | python-podman-api | 0:1.2.0-0.1.gitd0a45fe.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | runc | 0:1.0.0-61.rc8.module+el8.1.0+4873+4a24e241 |
| Red Hat Enterprise Linux 8 | runc-debuginfo | 0:1.0.0-61.rc8.module+el8.1.0+4873+4a24e241 |
| Red Hat Enterprise Linux 8 | runc-debugsource | 0:1.0.0-61.rc8.module+el8.1.0+4873+4a24e241 |
| Red Hat Enterprise Linux 8 | skopeo | 1:0.1.37-6.module+el8.1.0+4876+e678a192 |
| Red Hat Enterprise Linux 8 | skopeo-debuginfo | 1:0.1.37-6.module+el8.1.0+4876+e678a192 |
| Red Hat Enterprise Linux 8 | skopeo-debugsource | 1:0.1.37-6.module+el8.1.0+4876+e678a192 |
| Red Hat Enterprise Linux 8 | skopeo-tests | 1:0.1.37-6.module+el8.1.0+4876+e678a192 |
| Red Hat Enterprise Linux 8 | slirp4netns | 0:0.3.0-4.module+el8.1.0+4306+1d917805 |
| Red Hat Enterprise Linux 8 | slirp4netns-debuginfo | 0:0.3.0-4.module+el8.1.0+4306+1d917805 |
| Red Hat Enterprise Linux 8 | slirp4netns-debugsource | 0:0.3.0-4.module+el8.1.0+4306+1d917805 |
| Red Hat Enterprise Linux 8 | toolbox | 0:0.0.4-1.module+el8.1.0+4081+b29780af |
| Red Hat openshift 4.1 | runc | 0:1.0.0-62.rc8.rhaos4.1.git3cbe540.el8 |
| Red Hat openshift 4.1 | runc-debuginfo | 0:1.0.0-62.rc8.rhaos4.1.git3cbe540.el8 |
| Red Hat openshift 4.1 | runc-debugsource | 0:1.0.0-62.rc8.rhaos4.1.git3cbe540.el8 |
| Red Hat openshift 4.2 | runc | 0:1.0.0-63.rc8.el8 |
| Red Hat openshift 4.2 | runc-debuginfo | 0:1.0.0-63.rc8.el8 |
| Red Hat openshift 4.2 | runc-debugsource | 0:1.0.0-63.rc8.el8 |
| Red Hat rhel extras other 7 | docker | 2:1.13.1-161.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-client | 2:1.13.1-161.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-common | 2:1.13.1-161.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-debuginfo | 2:1.13.1-161.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-logrotate | 2:1.13.1-161.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-lvm-plugin | 2:1.13.1-161.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-novolume-plugin | 2:1.13.1-161.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-rhel-push-plugin | 2:1.13.1-161.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-v1.10-migrator | 2:1.13.1-161.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | runc | 0:1.0.0-67.rc10.el7_8 |
| Red Hat rhel extras other 7 | runc-debuginfo | 0:1.0.0-67.rc10.el7_8 |
| Rocky Linux 8 | oci-systemd-hook | 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f |
| Rocky Linux 8 | oci-umount | 2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f |
| SUSE Linux Enterprise Module for Containers 12 | containerd | 1.4.4-16.38.1 |
| SUSE Linux Enterprise Module for Containers 12 | containerd | 1.2.10-16.26.1 |
| SUSE Linux Enterprise Module for Containers 12 | docker | 20.10.6_ce-98.66.1 |
| SUSE Linux Enterprise Module for Containers 12 | docker | 19.03.5_ce-98.51.1 |
| SUSE Linux Enterprise Module for Containers 12 | docker-runc | 1.0.0rc8+gitr3917_3e425f80a8c9-1.35.1 |
| SUSE Linux Enterprise Module for Containers 12 | docker-runc | 1.0.0rc8+gitr3826_425e105d5a03-1.32.1 |
| SUSE Linux Enterprise Module for Containers 12 | golang-github-docker-libnetwork | 0.7.0.1+gitr2877_3eb39382bfa6-28.1 |
| SUSE Linux Enterprise Module for Containers 12 | runc | 1.0.0~rc93-16.8.1 |
| SUSE Linux Enterprise Module for Containers 15 | containerd | 1.2.10-5.19.1 |
| SUSE Linux Enterprise Module for Containers 15 | docker | 19.03.5_ce-6.31.1 |
| SUSE Linux Enterprise Module for Containers 15 | docker-runc | 1.0.0rc8+gitr3917_3e425f80a8c9-6.27.1 |
| SUSE Linux Enterprise Module for Containers 15 | docker-runc | 1.0.0rc8+gitr3826_425e105d5a03-6.24.1 |
| SUSE Linux Enterprise Module for Containers 15 | golang-github-docker-libnetwork | 0.7.0.1+gitr2877_3eb39382bfa6-4.18.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | containerd | 1.2.10-5.19.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | docker | 19.03.5_ce-6.31.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | docker-runc | 1.0.0rc8+gitr3917_3e425f80a8c9-6.27.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | docker-runc | 1.0.0rc8+gitr3826_425e105d5a03-6.24.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | golang-github-docker-libnetwork | 0.7.0.1+gitr2877_3eb39382bfa6-4.18.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | runc | 1.0.0~rc8-1.6.1 |
| Ubuntu 18.04 LTS | runc | 1.0.0~rc10-0ubuntu1~18.04.2 |
| Ubuntu 20.04 LTS | runc | 1.0.0~rc8+git20190923.3e425f80-0ubuntu1 |
| Ubuntu Pro 16.04 LTS | runc | 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2 |
| Wolfi | py3-docker | 0 |
| Wolfi | py3.10-docker | 0 |
| Wolfi | py3.11-docker | 0 |
| Wolfi | py3.12-docker | 0 |
| Wolfi | py3.13-docker | 0 |
| Wolfi | runc | 0 |
| Wolfi | runc-doc | 0 |
| openSUSE Leap 15.0 | docker-runc | 1.0.0rc8+gitr3826_425e105d5a03-lp150.5.28.1 |
| openSUSE Leap 15.1 | containerd | 1.2.10-lp151.2.9.1 |
| openSUSE Leap 15.1 | docker | 19.03.5_ce-lp151.2.15.1 |
| openSUSE Leap 15.1 | docker-runc | 1.0.0rc8+gitr3917_3e425f80a8c9-lp151.3.12.1 |
| openSUSE Leap 15.1 | docker-runc | 1.0.0rc8+gitr3826_425e105d5a03-lp151.3.9.1 |
| openSUSE Leap 15.1 | golang-github-docker-libnetwork | 0.7.0.1+gitr2877_3eb39382bfa6-lp151.2.9.1 |
| openSUSE Tumbleweed | runc | 1.0.2-1.2 |