CVE-2023-25809

runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.

• CWE-281

• https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17Patch
• https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fcExploit, Vendor Advisory
• https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17Patch
• https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fcExploit, Vendor Advisory

Published

Mar 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25802Roxy-WI is a Web interface for managing Haproxy, Nginx, Apac…7.5
• CVE-2023-25803Roxy-WI is a Web interface for managing Haproxy, Nginx, Apac…7.5
• CVE-2023-25804Roxy-WI is a Web interface for managing Haproxy, Nginx, Apac…5.3
• CVE-2023-25805versionn, software for changing version information across m…9.8
• CVE-2023-25806OpenSearch Security is a plugin for OpenSearch that offers e…5.3
• CVE-2023-25807DataEase is an open source data visualization and analysis t…5.4
• CVE-2023-25810Uptime Kuma is a self-hosted monitoring tool. In versions pr…5.4
• CVE-2023-25811Uptime Kuma is a self-hosted monitoring tool. In versions pr…5.4
• CVE-2023-25812Minio is a Multi-Cloud Object Storage framework. Affected ve…8.8
• CVE-2023-25813Sequelize is a Node.js ORM tool. In versions prior to 6.19.1…9.8
• CVE-2023-25814metersphere is an open source continuous testing platform. I…6.5
• CVE-2023-25815In Git for Windows, the Windows port of Git, no localized me…2.2