Read the docs
TI-2023-11079 Aliases CVE-2023-25809GHSA-m8cg-xc2p-r3fc

rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc

Priority LOW 28CWE-281Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 3 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial runc (opencontainers): 1.1.5github.com/opencontainers/runc (Go): 1.1.5Red Hat: 4 advisoriesRed Hat: 3 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstageruncbefore 1.1.51.1.5Patch availableCNA
—github.com/opencontainers/runc (Go)before 1.1.51.1.5Patch availableGHSA-m8cg-xc2p-r3fc
  • runc Vendorbackstage Affected before 1.1.5 Fixed in 1.1.5 Patch available CNA
  • github.com/opencontainers/runc (Go) Vendor— Affected before 1.1.5 Fixed in 1.1.5 Patch available GHSA-m8cg-xc2p-r3fc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*before 1.1.5Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions before 1.1.5 Vulnerable ·backstage

Remediation

  • Fix · CNA runc (opencontainers) Fixed in 1.1.5
  • Fix · GHSA-m8cg-xc2p-r3fc github.com/opencontainers/runc (Go) Fixed in 1.1.5 Advisory →

Red Hat 4 advisories

  • RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
  • RHSA-2023:6938 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.s390x::container-tools:4.0 +47
  • RHSA-2023:6380 Released 2023-11-07 · Red Hat rating Moderate
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.9-1.el9
Show 1 more Red Hat advisories
  • RHSA-2023:1326 Released 2023-05-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.0 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:6938, RHSA-2023:6939
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:6380
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:1326
Not affected: 2 products
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25809
  2. 2026-10-03 Alias added: GHSA-m8cg-xc2p-r3fc

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2024-14351 runc container breakout through process.cwd trickery and leaked fds CVSS 3.1HIGH 8.6
  • TI-2021-10869 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. CVSS 3.1HIGH 8.5
  • TI-2019-12591 runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows… CVSS 3.1HIGH 7.5
  • TI-2025-32660 container escape due to /dev/console mount and related races CVSS 4.0HIGH 8.4
  • TI-2025-22394 runc container escape via "masked path" abuse due to mount race conditions CVSS 4.0HIGH 7.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences