Go to main page
Versions in this module
v1
Mar 29, 2023
Aug 24, 2022
Jun 8, 2022
May 5, 2022
Mar 28, 2022
Jan 17, 2022
Changes in this version
type IntelRdt
type Resources
—
linux/amd64
Dec 14, 2021 GO-2022-0274
GO-2022-0274: An attacker with partial control over the bind mount sources of a new container can bypass namespace restrictions.
Dec 3, 2021 GO-2022-0274
GO-2022-0274: An attacker with partial control over the bind mount sources of a new container can bypass namespace restrictions.
Aug 20, 2021 GO-2022-0274
GO-2022-0274: An attacker with partial control over the bind mount sources of a new container can bypass namespace restrictions.
Changes in this version
type Resources
—
linux/amd64
Jul 16, 2021 GO-2022-0274
GO-2022-0274: An attacker with partial control over the bind mount sources of a new container can bypass namespace restrictions.
Jun 17, 2021
Changes in this version
type Action
type Cgroup
—
linux/amd64
type Config
type Mount
type NamespaceType
—
linux/amd64
type Seccomp
type Syscall
type ThrottleDevice
May 19, 2021
May 10, 2021
Feb 3, 2021
Aug 5, 2020
Jun 30, 2020
Jan 22, 2020
Sep 30, 2019 GO-2021-0087
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Apr 24, 2019 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Mar 28, 2019 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Nov 21, 2018 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Feb 27, 2018 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Aug 2, 2017 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Mar 21, 2017 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Sep 29, 2016 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Jan 22, 2020 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Jun 3, 2016 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
v0
Apr 25, 2016 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Apr 12, 2016 GO-2021-0085GO-2021-0087
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Changes in this version
type Command
type HookState
type Resources
—
linux/amd64
Mar 10, 2016 GO-2021-0070GO-2021-0085GO-2021-0087
GO-2021-0070: GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges.
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Changes in this version
type Hooks
type Namespaces
—
linux/amd64
Feb 10, 2016 GO-2021-0070GO-2021-0085GO-2021-0087
GO-2021-0070: GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges.
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Changes in this version
type Cgroup
—
linux/amd64
type Device
type Resources
—
linux/amd64
Jan 26, 2016 GO-2021-0070GO-2021-0085GO-2021-0087
GO-2021-0070: GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges.
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Changes in this version
type Cgroup
—
linux/amd64
Dec 11, 2015 GO-2021-0070GO-2021-0085GO-2021-0087
GO-2021-0070: GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges.
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Changes in this version
type Cgroup
—
linux/amd64
Nov 20, 2015 GO-2021-0070GO-2021-0085GO-2021-0087
GO-2021-0070: GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges.
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Changes in this version
type Action
type Cgroup
—
linux/amd64
type HookState
type Hooks
type Mount
type Seccomp
Sep 11, 2015 GO-2021-0070GO-2021-0085GO-2021-0087
GO-2021-0070: GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges.
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Changes in this version
type Action
type Arg
type Command
type Seccomp
type Syscall
Aug 4, 2015 GO-2021-0070GO-2021-0085GO-2021-0087
GO-2021-0070: GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges.
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Jul 17, 2015 GO-2021-0070GO-2021-0085GO-2021-0087
GO-2021-0070: GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges.
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.
Jul 16, 2015 GO-2021-0070GO-2021-0085GO-2021-0087
GO-2021-0070: GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges.
GO-2021-0085: AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.
GO-2021-0087: A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.