CVE-2023-25809

Name	CVE-2023-25809
Description	runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker\|podman\|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker\|podman\|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
runc (PTS)	bullseye	1.0.0~rc93+ds1-5+deb11u5	fixed
	bullseye (security)	1.0.0~rc93+ds1-5+deb11u3	vulnerable
	bookworm, bookworm (security)	1.1.5+ds1-1+deb12u1	fixed
	sid, trixie	1.1.15+ds1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
runc	source	buster	(not affected)
runc	source	bullseye	1.0.0~rc93+ds1-5+deb11u4
runc	source	(unstable)	1.1.5+ds1-1

Notes

[buster] - runc <not-affected> (Vulnerable code not present)
https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc
https://github.com/opencontainers/runc/commit/0e6b818a2b0d24fdb6697614e5c5f115bbe8e3a5 (v1.1.5)