Improper Preservation of Permissions Affecting criu-libs package, versions <0:3.18-4.module+el8.9.0+90021+ce997450

Q: How to fix?

<p>Upgrade <code>Oracle:8</code> <code>criu-libs</code> to version 0:3.18-4.module+el8.9.0+90021+ce997450 or higher.<br>This issue was patched in <code>ELSA-2023-6939</code>.</p>

Threat Intelligence

0.04% (9^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-ORACLE8-CRIULIBS-5798148
published 21 Jul 2023
disclosed 29 Mar 2023

Report a new vulnerability Found a mistake?

Introduced: 29 Mar 2023

CVE-2023-25809 Open this link in a new tab CWE-281 Open this link in a new tab

How to fix?

Upgrade Oracle:8 criu-libs to version 0:3.18-4.module+el8.9.0+90021+ce997450 or higher.
This issue was patched in ELSA-2023-6939.

NVD Description

Note: Versions mentioned in the description apply only to the upstream criu-libs package and not the criu-libs package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes /sys/fs/cgroup writable in following conditons: 1. when runc is executed inside the user namespace, and the config.json does not specify the cgroup namespace to be unshared (e.g.., (docker|podman|nerdctl) run --cgroupns=host, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and /sys is mounted with rbind, ro (e.g., runc spec --rootless; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy /sys/fs/cgroup/user.slice/... on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace ((docker|podman|nerdctl) run --cgroupns=private). This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add /sys/fs/cgroup to maskedPaths.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Local
Attack Complexity (AC)

Low
Privileges Required (PR)

Low
User Interaction (UI)

None

Scope (S)

Changed

Confidentiality (C)

Low
Integrity (I)

Low
Availability (A)

Low

Improper Preservation of Permissions Affecting criu-libs package, versions <0:3.18-4.module+el8.9.0+90021+ce997450

Severity

Based on Oracle Linux security rating