Executive brief
Rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in github.com/opencontainers/runc
Affected products
- Go github.com/opencontainers/runc
Junglewise Threat Intelligence
CVE-2023-25809: GO-2023-1682 - Rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in github.com/opencontainers/runc
CVE-2023-25809 · Severity: low · CVSS 3.1 · Published 2024-08-20
Technologies: github.com/opencontainers/runc (Go). Vendors: Go.
Related threats
- opencontainers runc symlink following in rootfs setup
- GO-2025-4096 - Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc
- GO-2025-4098 - Container escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc
- GO-2025-4097 - Container escape with malicious config due to /dev/console mount and related races in github.com/opencontainers/runc
- Libcontainer is affected by capabilities elevation similar to GHSA-f3fp-gc8g-vw66