Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
Vulnerability Description
runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Vulnerability Type
权限预留不恰当
Vulnerability Title
runc 安全漏洞
Vulnerability Description
runc是一款用于根据OCI规范生成和运行容器的CLI（命令行界面）工具。 runc 1.1.5之前版本存在安全漏洞，该漏洞源于runc在用户命名空间内执行时没有指定要取消共享的命名空间，在用户命名空间之外执行时可以获得对主机上用户的写访问权限。
CVSS Information
N/A
Vulnerability Type
N/A