{"id":"CVE-2023-25809","published":"2023-03-29T18:22:56Z","modified":"2025-02-12T16:02:24Z","title":"rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc","vendor":"opencontainers","product":"runc","tier":"tail","description":{"text":"runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.\n","provenance":"source","from":"CVE.org"},"cvss":{"score":5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00319,"percentile":0.2489,"provenance":"source"},"cwes":[{"id":"CWE-281","name":"Improper Preservation of Permissions"}],"references":[{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17","tags":["x_refsource_MISC"]}],"priority":{"score":8.5,"factors":[{"name":"EPSS percentile","points":4.98},{"name":"CVSS severity","points":3.5}]},"vendorSlug":"opencontainers","affectedVersions":[{"vendor":"opencontainers","product":"runc","versions":["< 1.1.5"]}],"affected":[{"ecosystem":"Go","package":"github.com/opencontainers/runc","vulnerableRanges":["<1.1.5"],"patched":["1.1.5"],"from":["GHSA-m8cg-xc2p-r3fc","GO-2023-1682"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1058","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencontainers-runc-cve-2016-9962","parents":[{"from":"CVE-2021-30465","to":"CVE-2023-25809","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f","https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17"],"basis":"shared function","functions":["mountCgroupV2"]}]}],"packageHistory":[{"cve":"CVE-2021-30465","published":"2021-05-27","fixed":"1.0.0-rc95","kev":false},{"cve":"CVE-2021-43784","published":"2021-12-06","fixed":"1.1.0","kev":false},{"cve":"CVE-2022-29162","published":"2022-05-17","fixed":"1.1.2","kev":false,"link":{"from":"CVE-2022-29162","to":"CVE-2023-25809","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.1.2","toFixed":"1.1.5","daysApart":316}]}},{"cve":"CVE-2023-25809","published":"2023-03-29","fixed":"1.1.5","kev":false},{"cve":"CVE-2023-27561","published":"2023-03-03","fixed":"1.1.5","kev":false},{"cve":"CVE-2023-28642","published":"2023-03-29","fixed":"1.1.5","kev":false},{"cve":"CVE-2024-21626","published":"2024-01-31","fixed":"1.1.12","kev":false,"link":{"from":"CVE-2023-25809","to":"CVE-2024-21626","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.1.5","toFixed":"1.1.12","daysApart":308}]}}],"package":"Go:github.com/opencontainers/runc"}}