CVE-2023-25809

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.

CVSS Metrics

• v3.1•MEDIUM•Score: 5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
• v3.1•MEDIUM•Score: 6.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
• v3.1•LOW•Score: 2.5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.04%• Percentile: 11%

Techniques & Countermeasures

• CWE-281•Improper Preservation of Permissions

  The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Affected Systems

• github.com/opencontainers•runc

  < 1.1.5

• linuxfoundation•runc

  < 1.1.5

• opencontainers•runc

  < 1.1.5

References (4)

• https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc
• https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17
• https://nvd.nist.gov/vuln/detail/CVE-2023-25809
• https://github.com/opencontainers/runc