BaseFortify

Publication date: 2025-11-06

Last updated on: 2025-12-03

Assigner: GitHub, Inc.

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-06

Last Modified

2025-12-03

Generated

2026-07-06

AI Q&A

2025-11-06

EPSS Evaluated

2026-07-05

NVD

CVE-2025-52565

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	runc	From 1.0.1 (inc) to 1.2.8 (exc)
linuxfoundation	runc	From 1.3.0 (inc) to 1.3.3 (exc)
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.0.0
linuxfoundation	runc	1.4.0
linuxfoundation	runc	1.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-61	The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
CWE-363	The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

Attack-Flow Graph

Executive Summary

This vulnerability in runc involves insufficient checks when bind-mounting /dev/pts/$n to /dev/console inside containers. An attacker can trick runc into bind-mounting paths that are normally read-only or masked onto writable paths. This can lead to denial of service or container breakout by allowing the attacker to write to sensitive files like /proc/sysrq-trigger or /proc/sys/kernel/core_pattern inside the container environment. The issue occurs after pivot_root, so it cannot be used to write directly to host files. It affects certain versions of runc and is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

Impact Analysis

This vulnerability can impact you by allowing an attacker to cause denial of service on the host or escape from the container environment (container breakout). By gaining writable access to normally protected system files within the container, an attacker could disrupt container or host operations or escalate privileges within the containerized environment.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade runc to a fixed version: 1.2.8, 1.3.3, or 1.4.0-rc.3 or later. Avoid using vulnerable versions (1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2) to prevent the risk of container breakout or denial of service.

Hi! I’m here to help you understand CVE-2025-52565. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70