x/vulndb: potential Go vuln in github.com/opencontainers/runc: CVE-2023-28642

[GoVulnBot]

CVE-2023-28642 references github.com/opencontainers/runc, which may be a Go module.

Description:
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-28642
• JSON: https://github.com/CVEProject/cvelist/tree/a19d0f778841cbe47e428f916574113e97112224/2023/28xxx/CVE-2023-28642.json
• advisory: GHSA-g2j6-57v7-gm8c
• fix: [1.1 backport] Prohibit /proc and /sys to be symlinks opencontainers/runc#3785
• Imported by: https://pkg.go.dev/github.com/opencontainers/runc?tab=importedby

Cross references:

• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: GHSA-g54h-m393-cpwq #396 EFFECTIVELY_PRIVATE
• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: CVE-2022-29162 #452 EFFECTIVELY_PRIVATE
• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: GHSA-gp4j-w3vj-7299 #835 NOT_IMPORTABLE
• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: CVE-2021-30465, GHSA-c3xm-pvg7-gh7r #914 NOT_IMPORTABLE
• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: GHSA-vpvm-3wq2-2wvm #1627 NOT_IMPORTABLE
• Module github.com/opencontainers/runc appears in issue dummy issue #70
• Module github.com/opencontainers/runc appears in issue dummy issue #85
• Module github.com/opencontainers/runc appears in issue dummy issue #87
• Module github.com/opencontainers/runc appears in issue x/vulndb: potential Go vuln in github.com/opencontainers/runc: CVE-2021-43784 #274

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/opencontainers/runc
    packages:
      - package: runc
description: |
    runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
cves:
  - CVE-2023-28642
references:
  - advisory: https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
  - fix: https://github.com/opencontainers/runc/pull/3785

[gopherbot]

Change https://go.dev/cl/480716 mentions this issue: data/excluded: batch add GO-2023-1683, GO-2023-1682, GO-2023-1679, GO-2023-1676, GO-2023-1680

[gopherbot]

Change https://go.dev/cl/592760 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606784 mentions this issue: data/reports: unexclude 20 reports (4)