Cyphar

An internal file descriptor leak in runc, a CLI tool for spawning and running containers on Linux according to the OCI specification, allows for multiple container breakouts. The issue occurs because a file descriptor remains open during the `setcwd(2)` operation, even when `O CLOEXEC` is used on all descriptors before executing container code. An attacker can maintain a reference to the host filesystem by configuring the working directory to a path resolved through this leaked descriptor. This can be exploited via `runc exec` to set a working directory in the host filesystem namespace or via a malicious image using `runc run` to gain host filesystem access. Furthermore, these methods can be used to overwrite semi-arbitrary host binaries, leading to a complete container escape and arbitrary code execution on the host.

The issue concerns a missing state in the software that fails to enforce the use of a second factor at login if the provider of the second factor fails to load.

The issue is related to incorrect access control, leading to escalation of privileges. An attacker must be able to spawn two containers with custom volume-mount configurations and run custom images to exploit this. The vulnerability is related to libcontainer/rootfs linux.go. By crafting a malicious root filesystem, an attacker can trick runc into not correctly configuring the container's security labels and not correctly masking paths inside /proc, which contain potentially-sensitive information about the host. This could allow for direct attacks against the host.