CVE-2019-16884
published 2019-09-25CVE-2019-16884: runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
4.41%
91.3th percentile
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | golang-github-opencontainers-selinux | < golang-github-opencontainers-selinux 1.3.0-2 (bookworm) | golang-github-opencontainers-selinux 1.3.0-2 (bookworm) |
| debian | runc | < golang-github-opencontainers-selinux 1.3.0-2 (bookworm) | golang-github-opencontainers-selinux 1.3.0-2 (bookworm) |
| docker | docker | <= 19.03.2 | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| github.com | opencontainers_runc | >= 0 < 1.0.0-rc8.0.20190930145003-cad42f6e0932 | 1.0.0-rc8.0.20190930145003-cad42f6e0932 |
| github.com | opencontainers_selinux | >= 0 < 1.3.1-0.20190929122143-5215b1806f52 | 1.3.1-0.20190929122143-5215b1806f52 |
| linuxfoundation | runc | — | — |
| linuxfoundation | runc | >= 0 < 1.0.0~rc9+dfsg1-1 | 1.0.0~rc9+dfsg1-1 |
| linuxfoundation | runc | >= 0 < 1.0.0~rc9+dfsg1-1 | 1.0.0~rc9+dfsg1-1 |
| linuxfoundation | runc | >= 0 < 1.0.0~rc9+dfsg1-1 | 1.0.0~rc9+dfsg1-1 |
| linuxfoundation | runc | >= 0 < 1.0.0~rc9+dfsg1-1 | 1.0.0~rc9+dfsg1-1 |
| linuxfoundation | runc | >= 0 < 1.0.0~rc10-0ubuntu1~18.04.2 | 1.0.0~rc10-0ubuntu1~18.04.2 |
| linuxfoundation | runc | >= 0 < 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2 | 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2 |
| linuxfoundation | runc | 0.0.1 – 0.1.1 | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_moby-buildx_0.4.1+azure-3_on_cbl_mariner_1.0 | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
runC regression
vendor_ubuntu·2025-11-24·CVSS 7.5
[HIGH] runC regression
Title: runC regression
Summary: USN-7851-1 introduced a regression in runC
USN-7851-1 fixed vulnerabilities in runC. The introduction of a new
upstream release has caused regressions in runc-app and runc-stable.
This update fixes the problem.
Original advisory details:
Lei Wang and Li Fubang discovered that runC incorrectly handled masked
paths. An attacker could possibly replace a container's /dev/null
with a symlink to some other procfs file and possibly escape a container.
(CVE-2025-31133)
Lei Wang and Li Fubang discovered that runC incorrectly handled the
/dev/console bind-mounts. An attacker could potentially exploit this issue
to build-mount a symlink and escape a container. (CVE-2025-52565)
Li Fubang and Tõnis Tiigi discovered that the fix for CVE-2019-16884 was
incomplete. An
Red Hat
runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects
vendor_redhat·2025-11-05·CVSS 7.5
CVE-2025-52881 [HIGH] CWE-59 runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects
runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-
Ubuntu
runC vulnerabilities
vendor_ubuntu·2025-11-04·CVSS 7.5
CVE-2025-52565 [HIGH] runC vulnerabilities
Title: runC vulnerabilities
Summary: Several security issues were fixed in runC.
Lei Wang and Li Fubang discovered that runC incorrectly handled masked
paths. An attacker could possibly replace a container's /dev/null
with a symlink to some other procfs file and possibly escape a container.
(CVE-2025-31133)
Lei Wang and Li Fubang discovered that runC incorrectly handled the
/dev/console bind-mounts. An attacker could potentially exploit this issue
to build-mount a symlink and escape a container. (CVE-2025-52565)
Li Fubang and Tõnis Tiigi discovered that the fix for CVE-2019-16884 was
incomplete. An attacker could possibly use this issue to cause a denial of
service or escape the container. (CVE-2025-52881)
Instructions: This update uses a new upstream release, which includes additiona
Ubuntu
runC vulnerabilities
vendor_ubuntu·2021-08-10·CVSS 7.5
CVE-2019-16884 [HIGH] runC vulnerabilities
Title: runC vulnerabilities
Summary: Several security issues were fixed in runC.
It was discovered that runC incorrectly checked mount targets. An attacker
with a malicious container image could possibly mount over the /proc
directory and escalate privileges. (CVE-2019-16884)
Etienne Champetier discovered that runC incorrectly checked mount targets.
An attacker with a malicious container image could possibly mount the host
filesystem into the container and escalate privileges. (CVE-2021-30465)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
runC vulnerabilities
vendor_ubuntu·2020-03-09·CVSS 7.5
CVE-2019-16884 [HIGH] runC vulnerabilities
Title: runC vulnerabilities
Summary: Several security issues were fixed in runc.
It was discovered that runC incorrectly checked mount targets. An attacker
with a malicious container image could possibly mount over the /proc
directory and escalate privileges. This issue only affected Ubuntu 18.04
LTS. (CVE-2019-16884)
It was discovered that runC incorrectly performed access control. An
attacker could possibly use this issue to escalate privileges.
(CVE-2019-19921)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc
vendor_redhat·2019-09-22·CVSS 7.5
CVE-2019-16884 [HIGH] CWE-41 runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc
runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Statement: The AppArmor security module is not supported by Red Hat, on the other hand the flaw also affects SELinux based distributions like Red Hat Enterprise Linux.
Package: container-tools:1.0/runc (Red Hat Enterprise Linux 8) - Out of support scope
Package: runc (Red Hat OpenShift Container Platform 3.9) - Out of support scope
Microsoft
runc through 1.0.0-rc8 as used in Docker through 19.03.2-ce and other products allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets and thus a malic
vendor_msrc·2019-09-10·CVSS 7.5
CVE-2019-16884 [HIGH] CWE-863 runc through 1.0.0-rc8 as used in Docker through 19.03.2-ce and other products allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets and thus a malic
runc through 1.0.0-rc8 as used in Docker through 19.03.2-ce and other products allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets and thus a malicious Docker image can mount over a /proc directory.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to ad
Debian
CVE-2019-16884: golang-github-opencontainers-selinux - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products,...
vendor_debian·2019·CVSS 7.5
CVE-2019-16884 [HIGH] CVE-2019-16884: golang-github-opencontainers-selinux - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products,...
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Scope: local
bookworm: resolved (fixed in 1.3.0-2)
bullseye: resolved (fixed in 1.3.0-2)
forky: resolved (fixed in 1.3.0-2)
sid: resolved (fixed in 1.3.0-2)
trixie: resolved (fixed in 1.3.0-2)
OSV
runc-app, runc-stable regression
osv·2025-11-24·CVSS 7.5
CVE-2025-31133 [HIGH] runc-app, runc-stable regression
runc-app, runc-stable regression
USN-7851-1 fixed vulnerabilities in runC. The introduction of a new
upstream release has caused regressions in runc-app and runc-stable.
This update fixes the problem.
Original advisory details:
Lei Wang and Li Fubang discovered that runC incorrectly handled masked
paths. An attacker could possibly replace a container's /dev/null
with a symlink to some other procfs file and possibly escape a container.
(CVE-2025-31133)
Lei Wang and Li Fubang discovered that runC incorrectly handled the
/dev/console bind-mounts. An attacker could potentially exploit this issue
to build-mount a symlink and escape a container. (CVE-2025-52565)
Li Fubang and Tõnis Tiigi discovered that the fix for CVE-2019-16884 was
incomplete. An attacker could possibly use this issue to
OSV
runc-app, runc-stable vulnerabilities
osv·2025-11-04·CVSS 7.5
CVE-2025-31133 [HIGH] runc-app, runc-stable vulnerabilities
runc-app, runc-stable vulnerabilities
Lei Wang and Li Fubang discovered that runC incorrectly handled masked
paths. An attacker could possibly replace a container's /dev/null
with a symlink to some other procfs file and possibly escape a container.
(CVE-2025-31133)
Lei Wang and Li Fubang discovered that runC incorrectly handled the
/dev/console bind-mounts. An attacker could potentially exploit this issue
to build-mount a symlink and escape a container. (CVE-2025-52565)
Li Fubang and Tõnis Tiigi discovered that the fix for CVE-2019-16884 was
incomplete. An attacker could possibly use this issue to cause a denial of
service or escape the container. (CVE-2025-52881)
GHSA
Incorrect Authorization in runc
ghsa·2022-02-22
CVE-2019-16884 [HIGH] CWE-863 Incorrect Authorization in runc
Incorrect Authorization in runc
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
OSV
Incorrect Authorization in runc
osv·2022-02-22
CVE-2019-16884 [HIGH] Incorrect Authorization in runc
Incorrect Authorization in runc
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
OSV
runc vulnerabilities
osv·2021-08-10·CVSS 7.5
CVE-2019-16884 [HIGH] runc vulnerabilities
runc vulnerabilities
It was discovered that runC incorrectly checked mount targets. An attacker
with a malicious container image could possibly mount over the /proc
directory and escalate privileges. (CVE-2019-16884)
Etienne Champetier discovered that runC incorrectly checked mount targets.
An attacker with a malicious container image could possibly mount the host
filesystem into the container and escalate privileges. (CVE-2021-30465)
OSV
Authorization bypass in github.com/opencontainers/runc
osv·2021-04-14
CVE-2019-16884 Authorization bypass in github.com/opencontainers/runc
Authorization bypass in github.com/opencontainers/runc
AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
OSV
runc vulnerabilities
osv·2020-03-09·CVSS 7.5
CVE-2019-16884 [HIGH] runc vulnerabilities
runc vulnerabilities
It was discovered that runC incorrectly checked mount targets. An attacker
with a malicious container image could possibly mount over the /proc
directory and escalate privileges. This issue only affected Ubuntu 18.04
LTS. (CVE-2019-16884)
It was discovered that runC incorrectly performed access control. An
attacker could possibly use this issue to escalate privileges.
(CVE-2019-19921)
OSV
CVE-2019-16884: runc through 1
osv·2019-09-25·CVSS 7.5
CVE-2019-16884 [HIGH] CVE-2019-16884: runc through 1
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-52881 runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects
bugzilla·2025-10-17·CVSS 7.5
CVE-2025-52881 [HIGH] CVE-2025-52881 runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects
CVE-2025-52881 runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects
A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:19927 https://access.redhat.com/errata/RHSA-2025:19927
---
This iss
Bugzilla
CVE-2019-16884 docker: runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc [openstack-rdo]
bugzilla·2019-10-11·CVSS 7.5
CVE-2019-16884 [HIGH] CVE-2019-16884 docker: runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc [openstack-rdo]
CVE-2019-16884 docker: runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Dis
Bugzilla
CVE-2019-16884 docker: runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc [fedora-all]
bugzilla·2019-10-11·CVSS 7.5
CVE-2019-16884 [HIGH] CVE-2019-16884 docker: runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc [fedora-all]
CVE-2019-16884 docker: runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this
Bugzilla
CVE-2019-16884 runc: AppArmor can be bypassed by a malicious image that specifies a volume at /proc [fedora-all]
bugzilla·2019-10-01·CVSS 7.5
CVE-2019-16884 [HIGH] CVE-2019-16884 runc: AppArmor can be bypassed by a malicious image that specifies a volume at /proc [fedora-all]
CVE-2019-16884 runc: AppArmor can be bypassed by a malicious image that specifies a volume at /proc [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2019-16884 runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc
bugzilla·2019-09-30·CVSS 7.5
CVE-2019-16884 [HIGH] CVE-2019-16884 runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc
CVE-2019-16884 runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
References:
https://github.com/opencontainers/runc/issues/2128
Discussion:
Created runc tracking bugs for this issue:
Affects: fedora-all [bug 1757290]
---
According to the upstream bug report, this also affects SELinux labels:
- https://github.com/opencontainers/runc/issues/2128#issuecomment-535478352
---
Yes this is an SELinux issue as well as an AppArmor problem.
---
Created docker tracking bugs for this issue:
Affects: fedora-
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00073.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00010.htmlhttps://access.redhat.com/errata/RHSA-2019:3940https://access.redhat.com/errata/RHSA-2019:4074https://access.redhat.com/errata/RHSA-2019:4269https://github.com/opencontainers/runc/issues/2128https://lists.debian.org/debian-lts-announce/2023/02/msg00016.htmlhttps://lists.debian.org/debian-lts-announce/2023/03/msg00023.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62OQ2P7K5YDZ5BRCH2Q6DHUJIHQD3QCD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGK6IV5JGVDXHOXEKJOJWKOVNZLT6MYR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPK4JWP32BUIVDJ3YODZSOEVEW6BHQCF/https://security.gentoo.org/glsa/202003-21https://security.netapp.com/advisory/ntap-20220221-0004/https://usn.ubuntu.com/4297-1/http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00073.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00010.htmlhttps://access.redhat.com/errata/RHSA-2019:3940https://access.redhat.com/errata/RHSA-2019:4074https://access.redhat.com/errata/RHSA-2019:4269https://github.com/opencontainers/runc/issues/2128https://lists.debian.org/debian-lts-announce/2023/02/msg00016.htmlhttps://lists.debian.org/debian-lts-announce/2023/03/msg00023.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62OQ2P7K5YDZ5BRCH2Q6DHUJIHQD3QCD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGK6IV5JGVDXHOXEKJOJWKOVNZLT6MYR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPK4JWP32BUIVDJ3YODZSOEVEW6BHQCF/https://security.gentoo.org/glsa/202003-21https://security.netapp.com/advisory/ntap-20220221-0004/https://usn.ubuntu.com/4297-1/
2019-09-25
Published