CVE-2023-25809: rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in runc

Background

The package under scrutiny is github.com/opencontainers/runc, which is written in Go. Runc is a lightweight, portable container runtime that is part of the Open Container Initiative (OCI) project. It provides an interface for creating and managing containers on Linux systems. Runc allows users to run containers securely by isolating them from the host system. However, a vulnerability has been discovered in runc that allows a container to gain write access to user-owned cgroup hierarchy /sys/fs/cgroup/user.slice/... on the host. This vulnerability affects runc when it is executed inside the user namespace without unsharing the cgroup namespace or when executed outside the user namespace with /sys mounted as rbind, ro.

Vulnerability Detail

The vulnerability in runc arises from the fact that it makes /sys/fs/cgroup writable under certain conditions. When runc is executed inside the user namespace without unsharing the cgroup namespace or when executed outside the user namespace with /sys mounted as rbind, ro, a container can gain write access to the user-owned cgroup hierarchy on the host. This can potentially allow an attacker to modify the cgroup settings and disrupt the behavior of other containers or the host system. It is important to note that only user-owned cgroup hierarchies are affected, and other users' hierarchies remain unaffected.

go get github.com/opencontainers/runc@v1.5.2

go get github.com/opencontainers/runc@v1.1.5

Workaround

There are two possible workarounds for this vulnerability:

1. Condition 1: Unshare the cgroup namespace by executing runc with the '--cgroupns=private' flag. This can be done with the following command: '(docker|podman|nerdctl) run --cgroupns=private'. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts.

2. Condition 2 (very rare): Add '/sys/fs/cgroup' to the 'maskedPaths' configuration. This can be done by modifying the 'config.json' file and adding '/sys/fs/cgroup' to the 'maskedPaths' array.

Conclusion

In conclusion, the vulnerability in runc allows a container to gain write access to user-owned cgroup hierarchy /sys/fs/cgroup/user.slice/... on the host. This can potentially lead to unauthorized modification of cgroup settings and disruption of other containers or the host system. It is recommended to update runc to version 1.1.5 or later to fix this vulnerability. Users can also consider implementing the provided workarounds if updating is not immediately feasible. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/opencontainers/runc →

FAQ