CVE-2025-52881
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-06

Last updated on: 2025-12-03

Assigner: GitHub, Inc.

Description
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-06
Last Modified
2025-12-03
Generated
2026-05-07
AI Q&A
2025-11-06
EPSS Evaluated
2026-05-05
NVD
CVE-2025-52881
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
linuxfoundation runc to 1.2.8 (exc)
linuxfoundation runc From 1.3.0 (inc) to 1.3.3 (exc)
linuxfoundation runc 1.4.0
linuxfoundation runc 1.4.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-363 The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in runc allows an attacker to trick runc into misdirecting writes to /proc to other procfs files by exploiting a race condition with containers that share mounts. This can be done using symbolic links in tmpfs or other methods like bind-mounts. The issue affects certain versions of runc and is fixed in later versions.


How can this vulnerability impact me? :

The vulnerability can allow an attacker to redirect writes intended for /proc to other procfs files, potentially leading to unauthorized modification of system files or data within containers. This could compromise container isolation and security, leading to privilege escalation or data integrity issues.


What immediate steps should I take to mitigate this vulnerability?

Upgrade runc to version 1.2.8, 1.3.3, or 1.4.0-rc.3 or later, as these versions contain the fix for this vulnerability.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart