Cyphar

**Name of the Vulnerable Software and Affected Versions** runc versions 1.0.0-rc93 through 1.1.11 containerd versions 1.4.7 through 1.6.27 containerd versions 1.7.0 through 1.7.12 Docker versions 20.10.8 through 24.0.8 Docker versions 24.0.9 through 25.0.2 **Description** An internal file descriptor leak in runc, a CLI tool for spawning and running containers on Linux according to the OCI specification, allows for multiple container breakouts. The issue occurs because a file descriptor remains open during the `setcwd(2)` operation, even when `O CLOEXEC` is used on all descriptors before executing container code. This allows a reference to be maintained within the container by configuring the working directory to a path resolved through that file descriptor. Exploitation can occur in several ways: - A newly-spawned container process via `runc exec` can have a working directory in the host filesystem namespace, granting access to the host filesystem. - A malicious image can use `runc run` to gain access to the host filesystem. - Variants of these methods can be used to overwrite semi-arbitrary host binaries, leading to a complete container escape and arbitrary code execution outside the isolated environment. **Recommendations** Update runc to version 1.1.12. Update containerd to version 1.6.28 or 1.7.13. Update Docker to version 24.0.9 or 25.0.2. As a temporary mitigation, close all unneeded file descriptors to prevent the leak from being exploited.

**Name of the Vulnerable Software and Affected Versions** Nextcloud Server versions prior to 14.0.0 **Description** The issue concerns a missing state in the software that fails to enforce the use of a second factor at login if the provider of the second factor fails to load. **Recommendations** For versions prior to 14.0.0, update to version 14.0.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** runc versions through 1.0.0-rc9 runc version 1.0.0-rc10 is not affected, as it contains the fix for this issue. **Description** The issue is related to incorrect access control, leading to escalation of privileges. An attacker must be able to spawn two containers with custom volume-mount configurations and run custom images to exploit this. The vulnerability is related to libcontainer/rootfs linux.go. By crafting a malicious root filesystem, an attacker can trick runc into not correctly configuring the container's security labels and not correctly masking paths inside /proc, which contain potentially-sensitive information about the host. This could allow for direct attacks against the host. **Recommendations** For runc versions through 1.0.0-rc9, update to version 1.0.0-rc10 to resolve the issue. As a temporary workaround, consider restricting access to custom volume mount configurations and custom images to minimize the risk of exploitation. Review access policies to ensure that untrusted users do not have high levels of control over container mount configuration.