Description

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.9",
  "pubDate": "2026-09-02T16:17:23.687Z",
  "pubdate": "2026-09-02T16:17:23.687Z",
  "executiveSummary": "This vulnerability involves an improper privilege management flaw within the nsenter utility, specifically concerning the --join-cgroup functionality. The flaw allows a local, unprivileged attacker to perform unauthorized cgroup migrations by hijacking an open file descriptor created during a privileged execution.\nThe vulnerability occurs because nsenter maintains an open file descriptor to the target cgroup.procs file with root privileges, which persists across subsequent namespace transitions, credential drops, and execve() syscalls. By exploiting this, an attacker within an environment joined via --join-cgroup can manipulate cgroup assignments, effectively moving arbitrary host processes between cgroups.\nThe impact is significant, as it permits an attacker to perform denial-of-service (DoS) attacks, resource exhaustion, or the termination of critical root-owned processes by migrating them into restricted or malicious cgroups. The vulnerability requires a privileged operator to initiate the --join-cgroup action against a target that the attacker subsequently controls. This represents a critical escalation vector in multi-tenant or containerized environments where nsenter is utilized for administrative task execution.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper lifecycle management of file descriptors when using the --join-cgroup option in nsenter. When nsenter is invoked with this flag, it opens the target's cgroup.procs file while operating under the initial root credentials of the administrator. Critically, this file descriptor remains open and associated with the process even after the utility performs namespace transitions, drops elevated privileges, and executes a target binary via execve().\nIn the Linux kernel, cgroup migration checks are validated against the credentials of the process that originally opened the file descriptor rather than the process attempting the write operation at the time of the migration. Because the persistent file descriptor was opened by the root-privileged nsenter instance, any subsequent write operations performed through that descriptor—even after the process has lowered its privileges—are treated by the kernel as having the original root authority.\nThe exploitation flow proceeds as follows: 1) A privileged administrator executes 'nsenter --join-cgroup' on a target environment. 2) The attacker, who has gained control over a process within that target environment, identifies the open file descriptor inheriting from the parent nsenter process. 3) The attacker utilizes this descriptor to perform writes to the cgroup.procs file. 4) The kernel validates the migration request based on the file descriptor's origin (root), effectively bypassing the attacker's actual unprivileged status. 5) By successfully writing the process IDs (PIDs) of host-level root processes into a target cgroup, the attacker gains the ability to move, throttle, or terminate those processes.\nThis behavior violates the principle of least privilege, as the security context of the file descriptor does not accurately reflect the current security context of the process attempting to write to the cgroup. The vulnerability is persistent as long as the hijacked file descriptor remains open in the context of the spawned child process, effectively granting the attacker a persistent handle to perform restricted cgroup operations on the host system."
}