CVE-2023-28642: runc AppArmor/SELinux confinement bypass via a symlinked or non-directory /proc inside the container
Scope: audit · README · COMPARISON · docs/RESEARCH
Fixed in runc 1.1.5 (USN-6088-1), same release as CVE-2023-27561.
Source
Relevance to doos
runc let /proc inside the container be a symlink, or let something be mounted over a
non-directory in its place, which bypassed its AppArmor and (on the right distro)
SELinux restrictions tied to the real /proc. doos has no comparable confinement layered
on top of /proc to bypass (same caveat as CVE-2019-16884: no per-container AppArmor
profile), but the underlying property, that /proc is a genuine, fresh directory mount
and not a symlink an image could have planted, is exactly the same /proc doos sets up
in src/sandbox.cpp and worth checking directly rather than only by analogy.
What the check does
From inside a container, confirms /proc is a directory and not a symlink
([ -L /proc ] must be false), on top of the mount-type check CVE-2019-16884 already
runs.
Caveats
Checks the filesystem property the runc bug abused (a symlinked /proc), not the
AppArmor/SELinux bypass itself, since doos's hardening model (seccomp + capability drop,
not AppArmor confinement of the container's own filesystem) is a different mechanism;
see COMPARISON.md section 6 for that design difference.
Run: make test in this directory, or make -C audit test from the repo root.