CVE-2019-16884
runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · September 22, 2019
Updated · November 22, 2025
Description
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Statement
The AppArmor security module is not supported by Red Hat, on the other hand the flaw also affects SELinux based distributions like Red Hat Enterprise Linux.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 6.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CWE-41 · Improper Resolution of Path Equivalence