CVE-2019-16884

Exp

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

Published: 2019-09-25 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2019-16884 is rated High Exploit Risk (80.5/100): CVSS High severity, with medium exploitation likelihood (EPSS 4.37%). 1 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +4.04% over the last day, indicating growing attacker interest. Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2019-16884

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2019-16884

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.34% 4.37% +4.04%
2 2026-04-05 0.48% 0.34% -0.15%
3 2026-03-29 — 0.48% —

Full EPSS history (28 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2019-16884

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 3.6 [email protected]
5.0 2.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:N)
No availability impact.
 10.0 2.9 [email protected]

Weakness enumeration for CVE-2019-16884

GitHub Security Advisory for CVE-2019-16884

OS Trackers for CVE-2019-16884

vendor priority summary link
alpine high CVE-2019-16884: 2 source package rows (containerd, runc); 15 state rows across 7 repos (3.17-community, 3.18-community, 3.19-community, 3.20-community, 3.21-community, 3.22-community, edge-community); fixed 15, open 0. https://security.alpinelinux.org/vuln/CVE-2019-16884
debian not yet assigned CVE-2019-16884 not yet assigned priority: Debian including 2 source packages (golang-github-opencontainers-selinux, runc), 10 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 10. https://security-tracker.debian.org/tracker/CVE-2019-16884
gentoo high CVE-2019-16884: 1 GLSA(s) (202003-21), 1 atom(s) (app-emulation/runc); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2019-16884
redhat medium — https://access.redhat.com/security/cve/CVE-2019-16884
suse medium CVE-2019-16884 severity moderate: SUSE including 293 source package names (2.0.2-4.2.20:runc-1.0.0~rc8-1.6.1, amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, …), 1230 product×package rows across 305 product lines (Container rancher/elemental-teal-iso/5.4, Container rancher/elemental-teal-rt/5.4, … (305 product lines)): Fixed 1073, Known Affected 157. https://www.suse.com/security/cve/CVE-2019-16884/
ubuntu medium CVE-2019-16884 medium priority: Ubuntu including 1 source packages (runc), 11 status rows across 11 suites (bionic, disco, eoan, focal, groovy, hirsute, impish, jammy, trusty, upstream, xenial): released 9, DNE 1, ignored 1. https://ubuntu.com/security/CVE-2019-16884

Affected software / configurations for CVE-2019-16884

Vendor Product Version Raw CPE
linuxfoundation runc >= 0.0.1, <= 0.1.1 cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*
linuxfoundation runc 1.0.0 cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:*
linuxfoundation runc 1.0.0 cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:*
linuxfoundation runc 1.0.0 cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*
linuxfoundation runc 1.0.0 cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*
linuxfoundation runc 1.0.0 cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*
linuxfoundation runc 1.0.0 cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*
linuxfoundation runc 1.0.0 cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:*
linuxfoundation runc 1.0.0 cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:*
docker docker <= 19.03.2 cpe:2.3:a:docker:docker:*:*:*:*:community:*:*:*
fedoraproject fedora 29 cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
fedoraproject fedora 30 cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
fedoraproject fedora 31 cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
opensuse leap 15.0 cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
opensuse leap 15.1 cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
redhat openshift_container_platform 4.1 cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
redhat openshift_container_platform 4.2 cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:*
redhat enterprise_linux 8.0 cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhat enterprise_linux_eus 8.1 cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
redhat enterprise_linux_eus 8.2 cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
redhat enterprise_linux_eus 8.4 cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 8.2 cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 8.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 8.2 cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 8.4 cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
canonical ubuntu_linux 18.04 cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
canonical ubuntu_linux 19.10 cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

References for CVE-2019-16884

URL Tags
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00073.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00009.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00010.html Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3940 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4074 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4269 Third Party Advisory
https://github.com/opencontainers/runc/issues/2128 Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00016.html
https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62OQ2P7K5YDZ5BRCH2Q6DHUJIHQD3QCD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGK6IV5JGVDXHOXEKJOJWKOVNZLT6MYR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPK4JWP32BUIVDJ3YODZSOEVEW6BHQCF/
https://security.gentoo.org/glsa/202003-21 Third Party Advisory
https://security.netapp.com/advisory/ntap-20220221-0004/ Third Party Advisory
https://usn.ubuntu.com/4297-1/ Third Party Advisory
cvelogic Threat Intelligence