^{CVE-2023-27561:}runc through 1.1.4 has an Incorrect Access Control vulnerability that can lead to privilege escalation.

Overview

This vulnerability (CVE-2023-27561) affects runc, a CLI tool for spawning and running containers according to the OCI specification. The issue is classified as CWE-706 (Incorrect Access Control), allowing attackers to potentially escalate privileges under specific conditions. The vulnerability occurs in the rootfs_linux.go component of libcontainer and represents a regression of a previously fixed vulnerability (CVE-2019-19921).

To successfully exploit this vulnerability, an attacker needs to have the ability to:

1. Spawn two containers with custom volume-mount configurations
2. Run custom container images

When these conditions are met, the attacker could potentially gain elevated privileges, compromising the security of the host system.

Remediation

To mitigate this vulnerability, users should:

1. Update runc to a version newer than 1.1.4 that contains the fix for this vulnerability.
2. If immediate updating is not possible, restrict the ability to create containers with custom volume mounts.
3. Monitor container activities for suspicious behaviors, especially those involving volume mounts.
4. Apply the principle of least privilege when configuring container permissions.
5. Consider implementing additional container security measures such as seccomp profiles, AppArmor, or SELinux to add defense-in-depth.

For Debian users, a security update is available as mentioned in the Debian LTS announcement (DLA 3369-1). Fedora users should apply the security updates mentioned in the referenced Fedora package announcements.

References

1. Exploit and analysis: https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9
2. Issue tracking: https://github.com/opencontainers/runc/issues/3751
3. Original issue with regression comment: https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334
4. Debian LTS security announcement: https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
5. Fedora security updates:
   • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/
   • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/
   • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/
   • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/
   • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/
6. NetApp security advisory: https://security.netapp.com/advisory/ntap-20241206-0004/