Multiple vulnerabilities in runc
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2023-25809 CVE-2023-27561 CVE-2023-28642 |
| CWE-ID | CWE-281 CWE-284 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
runc Client/Desktop applications / Other client software |
| Vendor | Open Container Initiative |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Improper Preservation of Permissions
EUVDB-ID: #VU74189
Risk: Low
CVSSv3.1: 2.2 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-25809
CWE-ID:
CWE-281 - Improper preservation of permissions
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the rootless "/sys/fs/cgroup" is writable when cgroupns is not unshared. A local administrator can gain the write access to user-owned cgroup hierarchy "/sys/fs/cgroup/user.slice/..." on the host.
MitigationInstall updates from vendor's website.
Vulnerable software versionsrunc: 1.0 rc1 - 1.1.4
External linkshttp://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc
http://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper access control
EUVDB-ID: #VU74190
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-27561
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to improper access restrictions in the libcontainer/rootfs_linux.go. A local user can gain elevated privileges on the target system.
MitigationInstall update from vendor's website.
Vulnerable software versionsrunc: 1.0.0 - 1.1.4
External linkshttp://github.com/opencontainers/runc/issues/3751
http://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9
http://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334
http://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
http://github.com/advisories/GHSA-vpvm-3wq2-2wvm
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper Preservation of Permissions
EUVDB-ID: #VU74193
Risk: Medium
CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-28642
CWE-ID:
CWE-281 - Improper preservation of permissions
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to improper preservation of permissions in the AppArmor and SELinux when /proc inside the container is symlinked with a specific mount configuration. A remote attacker can gain access to the target application.
MitigationInstall updates from vendor's website.
Vulnerable software versionsrunc: 1.0 rc1 - 1.1.4
External linkshttp://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
http://github.com/opencontainers/runc/pull/3785
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
