runc: LSM labels can be bypassed with malicious config using dummy procfs files

runc is a CLI tool for spawning and running containers according to the OCIspecification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker cantrick runc into misdirecting writes to /proc to other procfs files throughthe use of a racing container with shared mounts (we have also verifiedthis attack is possible to exploit using a standard Dockerfile with dockerbuildx build as that also permits triggering parallel execution ofcontainers with custom shared mounts configured). This redirect could bethrough symbolic links in a tmpfs or theoretically other methods such asregular bind-mounts. While similar, the mitigation applied for the relatedCVE, CVE-2019-19921, was fairly limited and effectively only caused runc toverify that when LSM labels are written they are actually procfs files.This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

Where it's fixed