runc: AppArmor restriction bypass via mount-target check flaw

Impact

AppArmor restriction bypass via mount-target check flaw; container can mount over /proc

Who can reach it

Malicious image

What to do

Replace runc binary; drain node to restart existing containers

References

Related entries

• runc: Insufficient verification of masked-path bind mounts (/dev/null replaced by symlink) enables containerCVE-2025-31133 · runcHigh
• runc: Attacker misdirects runc writes to /proc via racing symlinksCVE-2025-52881 · runcHigh
• runc: Volume-mount race gives incorrect access control and privilege escalation to hostCVE-2019-19921 · runcHigh
• runc: Regression of CVE-2019-19921: incorrect access control leading to privilege escalation via volume mountsCVE-2023-27561 · runcHigh
• runc: AppArmor bypass when /proc inside the container is symlinked with a specific mount configCVE-2023-28642 · runcMedium
• runc: Netlink bytemsg length integer overflow in libcontainer allows config injection / partial escapeCVE-2021-43784 · runcMedium