Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/opencontainers/selinux

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.3GoPublished

    runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects

    CVE-2025-52881 · GHSA-cgrx-mc8f-2prm

    Affected
    • Go github.com/opencontainers/selinux <= 1.12.0
    Fixed in
    1.13.0· Vendor fix available
    Issue
    Impact This attack is primarily a more sophisticated version of CVE-2019-19921, which was a flaw which allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation runc applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when runc writes LSM labels that those labels are actual procfs files. Rather than using a fake tmpfs file for /proc/self/attr/<label, an attacker could instead (through various means) make /proc/self/attr/<label reference a real procfs file, but one that would still be a no-op (such as /proc/self/sched). This would have the same effect but would clear the "is a procfs file" check. Runc is aware that this kind of attack would be possible (even going so far as to discuss this publicly as "future work" at conferences), and runc is working on a far more comprehensive mitigation of this…

    Recommended action: Upgrade to 1.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.5GoPublished

    Incorrect Authorization in runc

    CVE-2019-16884 · GHSA-fgv8-vj5c-2ppq

    Affected
    • Go github.com/opencontainers/selinux < 1.3.1-0.20190929122143-5215b1806f52
    Fixed in
    1.3.1-0.20190929122143-5215b1806f52· Vendor fix available
    Issue
    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

    Recommended action: Upgrade to 1.3.1-0.20190929122143-5215b1806f52 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →