GHSA-G54H-M393-CPWQ devices resource list treated as a blacklist by default

Impact Contrary to the OCI runtime specification, runc's implementation of the linux.resources.devices list was a black-list by default. This means that users who created their own config.json objects and didn't prefix a deny-all rule "allow": false, "permissions": "rwm" or equivalent were not...

Insecure Authorization

github.com/opencontainers/runc does not provide secure authorization. Users who have created their config.json objects and did not prefix a deny-all rule "allow": false, "permissions": "rwm" or equivalent were not provided protection by the devices cgroup. This would allow malicious containers wi...