CVE:CVE-2019-16884
CNNVD:CNNVD-201909-1170
runc是一款用于根据OCI规范生成和运行容器的CLI（命令行界面）工具。
runc 1.0.0-rc8及之前版本（使用在Docker 19.03.2-ce及之前版本和其他产品）中存在安全漏洞，该漏洞源于libcontainer/rootfs_linux.go文件没有正确检查挂载目标。攻击者可利用该漏洞绕过AppArmor限制。
solution:Upgrade linuxfoundation runc to a higher version than 0.1.1,1.0.0:rc1,1.0.0:rc2,1.0.0:rc3,1.0.0:rc4,1.0.0:rc5,1.0.0:rc6,1.0.0:rc7,1.0.0:rc8,and avoid the version [0.0.1,0.1.1],1.0.0:rc1,1.0.0:rc2,1.0.0:rc3,1.0.0:rc4,1.0.0:rc5,1.0.0:rc6,1.0.0:rc7,1.0.0:rc8; Upgrade docker docker to a higher version than 19.03.2,and avoid the version (,19.03.2]; Upgrade fedoraproject fedora to a higher version than 29,30,31,and avoid the version 29,30,31; Upgrade opensuse leap to a higher version than 15.0,15.1,and avoid the version 15.0,15.1; Upgrade redhat openshift_container_platform to a higher version than 4.1,4.2,and avoid the version 4.1,4.2; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade redhat enterprise_linux_eus to a higher version than 8.1,8.2,8.4,and avoid the version 8.1,8.2,8.4; Upgrade redhat enterprise_linux_server_aus to a higher version than 8.2,8.4,and avoid the version 8.2,8.4; Upgrade redhat enterprise_linux_server_tus to a higher version than 8.2,8.4,and avoid the version 8.2,8.4; Upgrade canonical ubuntu_linux to a higher version than 18.04,19.10,and avoid the version 18.04,19.10