FlawAtlas
Search the atlas
CVE-2019-16884 High

CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

Exploit probability 4.4%
Published September 25, 2019
Required by Not available
Last source change August 7, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

23 explicit affected versions

Go github.com/opencontainers/runc
Go github.com/opencontainers/selinux
Go github.com/opencontainers/runc
Go github.com/opencontainers/selinux

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities GHSA-fgv8-vj5c-2ppq

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

View original source
Open Source Vulnerabilities GO-2021-0085

AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.

View original source
Open Source Vulnerabilities CVE-2019-16884

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

View original source

05 / REFERENCES

Further evidence