CVE-2023-28642 AppArmor bypass with symlinked /proc in runc
Attackers can bypass AppArmor security controls in runc containers by exploiting symlinked /proc mounts, requiring specific configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-28642?
CVE-2023-28642 is a medium-severity vulnerability in opencontainers runc, published on 29 Mar 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image.
Which versions are affected by CVE-2023-28642?
3 open source packages ship an affected version, including github.com/opencontainers/runc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/opencontainers/runc Go | All versions | 1.1.5 |
github.com/opencontainers/runc Go | All versions | 1.1.5 |
github.com/opencontainers/runc Go | All versions | 1.1.5 |
Products include Linuxfoundation Runc.
How do I fix CVE-2023-28642?
Upgrade github.com/opencontainers/runc to 1.1.5 or later.
Is CVE-2023-28642 being exploited?
There is no known exploitation of CVE-2023-28642 in the wild and no public exploit code.
Other vulnerabilities in opencontainers runc
- CVE-2025-52565 container escape due to /dev/console mount and related races
- CVE-2025-31133 runc container escape via "masked path" abuse due to mount race conditions
- CVE-2025-52881 runc: LSM labels can be bypassed with malicious config using dummy procfs files
- CVE-2023-25809 rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
- CVE-2024-45310 runc can be confused to create empty files/directories on the host
Sources
Also known as AZL-25850, CLEANSTART-2026-HM12988, DEBIAN-CVE-2023-28642, GHSA-g2j6-57v7-gm8c, GO-2023-1683, OESA-2023-1217 and 3 more.