Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 903079 (CVE-2023-25809, CVE-2023-27561, CVE-2023-28642) - <app-containers/runc-1.1.5: Privilege escalation bug
Summary: <app-containers/runc-1.1.5: Privilege escalation bug
Status: IN_PROGRESS
Alias: CVE-2023-25809, CVE-2023-27561, CVE-2023-28642
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://github.com/opencontainers/run...
Whiteboard: B2 [glsa?]
Keywords: PATCH
Depends on:
Blocks:
 
Reported: 2023-03-26 01:19 UTC by Sam James
Modified: 2023-10-13 13:00 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-03-26 01:19:16 UTC 
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-03-26 01:19:55 UTC 
Patch: https://github.com/opencontainers/runc/pull/3785
Comment 2 Mathieu Tortuyaux 2023-03-29 10:10:28 UTC 
runc 1.1.5 is out and it fixes two more CVEs:

* CVE-2023-25809: is a vulnerability involving rootless containers where
(under specific configurations), the container would have write access to the /sys/fs/cgroup/user.slice/... cgroup hierarchy. No other hierarchies on the host were affected. This vulnerability was discovered by Akihiro Suda.

* CVE-2023-28642: is a variant of the same bug and was fixed by the same
patch. This variant of the above vulnerability was reported by Lei Wang.

https://github.com/opencontainers/runc/releases/tag/v1.1.5
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-04-30 22:32:05 UTC 
commit 082f7b1e24a65be9c7b8d09cab220a68a3aca164
Author: William Hubbs <williamh@gentoo.org>
Date:   Sun Apr 23 16:33:55 2023 -0500

    app-containers/runc: add 1.1.5

    Signed-off-by: William Hubbs <williamh@gentoo.org>
Comment 4 Hans de Graaff gentoo-dev Security 2023-10-13 13:00:58 UTC 
commit c5bf2a0bfa317aea69e2536b61e17e963257a8e9
Author: William Hubbs <williamh@gentoo.org>
Date:   Tue Jul 25 10:18:58 2023 -0500

    app-containers/runc: drop 1.1.4