CVE-2025-52565
BaseFortify
Publication date: 2025-11-06
Last updated on: 2025-12-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | runc | From 1.0.1 (inc) to 1.2.8 (exc) |
| linuxfoundation | runc | From 1.3.0 (inc) to 1.3.3 (exc) |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.0.0 |
| linuxfoundation | runc | 1.4.0 |
| linuxfoundation | runc | 1.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-363 | The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file. |
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in runc involves insufficient checks when bind-mounting /dev/pts/$n to /dev/console inside containers. An attacker can trick runc into bind-mounting paths that are normally read-only or masked onto writable paths. This can lead to denial of service or container breakout by allowing the attacker to write to sensitive files like /proc/sysrq-trigger or /proc/sys/kernel/core_pattern inside the container environment. The issue occurs after pivot_root, so it cannot be used to write directly to host files. It affects certain versions of runc and is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to cause denial of service on the host or escape from the container environment (container breakout). By gaining writable access to normally protected system files within the container, an attacker could disrupt container or host operations or escalate privileges within the containerized environment.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade runc to a fixed version: 1.2.8, 1.3.3, or 1.4.0-rc.3 or later. Avoid using vulnerable versions (1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2) to prevent the risk of container breakout or denial of service.