Improper Access Control

github.com/opencontainers/runc is vulnerable to Improper Access Control. The vulnerability exists because the rootless runc makes /sys/fs/cgroup writable when runc is executed inside the user namespace, and the config.json does not specify the cgroup namespace to be unshared (e.g…, (docker|podman|nerdctl) run --cgroupns=host, with Rootless Docker/Podman/nerdctl) or when runc is executed outside the user namespace, and /sys is mounted with rbind and ro (e.g., runc spec --rootless; this condition is very rare), which allows an attacker to gain the write access to user-owned cgroup hierarchy /sys/fs/cgroup/user.slice/... on the host.