CVE-2023-25809
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
概要
rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in runc
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Impact
It was found that rootless runc makes /sys/fs/cgroup writable in following conditons:
- when runc is executed inside the user namespace, and the
config.jsondoes not specify the cgroup namespace to be unshared (e.g..,(docker|podman|nerdctl) run --cgroupns=host, with Rootless Docker/Podman/nerdctl) - or, when runc is executed outside the user namespace, and
/sysis mounted withrbind, ro(e.g.,runc spec --rootless; this condition is very rare)
A container may gain the write access to user-owned cgroup hierarchy /sys/fs/cgroup/user.slice/... on the host .
Other users's cgroup hierarchies are not affected.
Patches
v1.1.5 (planned)
Workarounds
- Condition 1: Unshare the cgroup namespace (
(docker|podman|nerdctl) run --cgroupns=private). This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. - Condition 2 (very rare): add
/sys/fs/cgrouptomaskedPaths
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Go
github.com/opencontainers/runc
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.5"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-25809 runc 修正版: 1.0.0~rc93+ds1-5+deb11u4
参照URL
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com