CVE-2023-28642 - CVE House
Back to Database
Status published Medium CVE-2023-28642

AppArmor bypass with symlinked /proc in runc

Vulnerability Description

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28642

Credits & Attribution

No credits recorded in the NVD database.

References

More from opencontainers

View All →
CVE-2025-52881
runc: LSM labels can be bypassed with malicious config using dummy procfs files
High 7.3
CVE-2025-52565
container escape due to /dev/console mount and related races
High 8.4
CVE-2025-31133
runc container escape via "masked path" abuse due to mount race conditions
High 7.3
CVE-2024-45310
runc can be confused to create empty files/directories on the host
Low 3.6
CVE-2024-21626
runc container breakout through process.cwd trickery and leaked fds
High 8.6

Affected Vendor

opencontainers

View all reports →

Affected Software

runc
Vulnerable Versions:
< 1.1.5

Timeline

Official Publish: March 29th, 2023
Last Modified: February 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weaknesses (CWE)

CWE-281

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.