CVE-2023-25809
Published: 29 March 2023
runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.
Priority
Status
Package | Release | Status |
---|---|---|
runc Launchpad, Ubuntu, Debian |
bionic |
Released
(1.1.4-0ubuntu1~18.04.2)
|
focal |
Released
(1.1.4-0ubuntu1~20.04.3)
|
|
jammy |
Released
(1.1.4-0ubuntu1~22.04.3)
|
|
kinetic |
Released
(1.1.4-0ubuntu1~22.10.3)
|
|
lunar |
Released
(1.1.4-0ubuntu3.1)
|
|
trusty |
Ignored
(end of standard support)
|
|
upstream |
Released
(1.1.5+ds1-1)
|
|
xenial |
Released
(1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4)
Available with Ubuntu Pro |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.3 |
Attack vector | Local |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Changed |
Confidentiality | Low |
Integrity impact | Low |
Availability impact | Low |
Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809
- https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc
- https://github.com/opencontainers/runc/commit/0e6b818a2b0d24fdb6697614e5c5f115bbe8e3a5 (v1.1.5)
- https://ubuntu.com/security/notices/USN-6088-1
- https://ubuntu.com/security/notices/USN-6088-2
- NVD
- Launchpad
- Debian