runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes '/sys/fs/cgroup' writable in following conditons: 1. when runc is executed inside the user namespace, and the 'config.json' does not specify the cgroup namespace to be unshared or 2. when runc is executed outside the user namespace, and '/sys' is mounted with 'rbind, ro' . A container may gain the write access to user-owned cgroup hierarchy '/sys/fs/cgroup/user.slice/...' on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace '. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add '/sys/fs/cgroup' to 'maskedPaths'. runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression. runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when '/proc' inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked '/proc'. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image