{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/vex/2023/cve-2023-25809-els_os-almalinux9_2esu.json"
      }
    ],
    "title": "Security update on CVE-2023-25809",
    "tracking": {
      "current_release_date": "2025-12-23T19:08:30Z",
      "generator": {
        "date": "2025-12-23T19:08:30Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2023-25809-ELS_OS-ALMALINUX9.2ESU",
      "initial_release_date": "2023-03-29T19:15:00Z",
      "revision_history": [
        {
          "date": "2023-03-29T19:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-11-29T10:41:32Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2025-12-23T19:08:30Z",
          "number": "3",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "AlmaLinux 9.2",
                "product": {
                  "name": "AlmaLinux 9.2",
                  "product_id": "AlmaLinux-9.2",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:almalinux:almalinux:9.2:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "AlmaLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.2.8-1.el9_1.x86_64",
                "product": {
                  "name": "runc-4:1.2.8-1.el9_1.x86_64",
                  "product_id": "runc-4:1.2.8-1.el9_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/runc@1.2.8-1.el9_1?arch=x86_64&epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "runc-4:1.1.4-1.el9_1.x86_64",
                "product": {
                  "name": "runc-4:1.1.4-1.el9_1.x86_64",
                  "product_id": "runc-4:1.1.4-1.el9_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/runc@1.1.4-1.el9_1?arch=x86_64&epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "AlmaLinux OS Foundation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "runc-4:1.2.8-1.el9_1.tuxcare.els1.x86_64",
                "product": {
                  "name": "runc-4:1.2.8-1.el9_1.tuxcare.els1.x86_64",
                  "product_id": "runc-4:1.2.8-1.el9_1.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/runc@1.2.8-1.el9_1.tuxcare.els1?arch=x86_64&epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "runc-4:1.1.4-1.el9_1.tuxcare.els2.x86_64",
                "product": {
                  "name": "runc-4:1.1.4-1.el9_1.tuxcare.els2.x86_64",
                  "product_id": "runc-4:1.1.4-1.el9_1.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/runc@1.1.4-1.el9_1.tuxcare.els2?arch=x86_64&epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.2.8-1.el9_1.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2",
          "product_id": "AlmaLinux-9.2:runc-4:1.2.8-1.el9_1.tuxcare.els1.x86_64"
        },
        "product_reference": "runc-4:1.2.8-1.el9_1.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.2.8-1.el9_1.x86_64 as a component of AlmaLinux 9.2",
          "product_id": "AlmaLinux-9.2:runc-4:1.2.8-1.el9_1.x86_64"
        },
        "product_reference": "runc-4:1.2.8-1.el9_1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.1.4-1.el9_1.tuxcare.els2.x86_64 as a component of AlmaLinux 9.2",
          "product_id": "AlmaLinux-9.2:runc-4:1.1.4-1.el9_1.tuxcare.els2.x86_64"
        },
        "product_reference": "runc-4:1.1.4-1.el9_1.tuxcare.els2.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "runc-4:1.1.4-1.el9_1.x86_64 as a component of AlmaLinux 9.2",
          "product_id": "AlmaLinux-9.2:runc-4:1.1.4-1.el9_1.x86_64"
        },
        "product_reference": "runc-4:1.1.4-1.el9_1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-25809",
      "cwe": {
        "id": "CWE-281",
        "name": "Improper Preservation of Permissions"
      },
      "notes": [
        {
          "category": "description",
          "text": "runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.\n",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "AlmaLinux-9.2:runc-4:1.1.4-1.el9_1.tuxcare.els2.x86_64",
          "AlmaLinux-9.2:runc-4:1.1.4-1.el9_1.x86_64",
          "AlmaLinux-9.2:runc-4:1.2.8-1.el9_1.tuxcare.els1.x86_64",
          "AlmaLinux-9.2:runc-4:1.2.8-1.el9_1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2023-25809"
        },
        {
          "category": "external",
          "summary": "https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17",
          "url": "https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17"
        },
        {
          "category": "external",
          "summary": "https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc",
          "url": "https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc"
        }
      ],
      "release_date": "2023-03-29T19:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "This issue is only exploitable locally and requires a non-default setup that exposes the host cgroup namespace to a rootless container (e.g., --cgroupns=host) or an uncommon rbind,ro /sys mount. Even if triggered, access is limited to the invoking user’s own cgroup hierarchy under /sys/fs/cgroup/user.slice and does not yield cross-user access or host privilege escalation, aligning with the low confidentiality, integrity, and availability impact. Systems using the default cgroup v2 behavior (private cgroup namespace) do not meet the vulnerable conditions, making this a low-priority concern in managed enterprise VM/server environments.",
          "product_ids": [
            "AlmaLinux-9.2:runc-4:1.1.4-1.el9_1.tuxcare.els2.x86_64",
            "AlmaLinux-9.2:runc-4:1.1.4-1.el9_1.x86_64",
            "AlmaLinux-9.2:runc-4:1.2.8-1.el9_1.tuxcare.els1.x86_64",
            "AlmaLinux-9.2:runc-4:1.2.8-1.el9_1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AlmaLinux-9.2:runc-4:1.1.4-1.el9_1.tuxcare.els2.x86_64",
            "AlmaLinux-9.2:runc-4:1.1.4-1.el9_1.x86_64",
            "AlmaLinux-9.2:runc-4:1.2.8-1.el9_1.tuxcare.els1.x86_64",
            "AlmaLinux-9.2:runc-4:1.2.8-1.el9_1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}