CVE-2025-62596
BaseFortify
Publication date: 2025-11-06
Last updated on: 2025-11-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| youki-dev | youki | to 0.5.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
| CWE-363 | The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Youki container runtime (versions 0.5.6 and below) involves insufficiently strict validation of write targets in its AppArmor handling. When combined with path substitution during pathname resolution, an attacker can exploit a shared-mount race condition to substitute intermediate path components and redirect writes to unintended procfs locations. This can lead to unauthorized writes to sensitive system files. The issue is fixed in version 0.5.7.
How can this vulnerability impact me? :
The vulnerability can allow an attacker with limited privileges to write to unintended procfs locations, potentially leading to unauthorized modification of system files or configurations. This could compromise system integrity, escalate privileges, or disrupt container runtime behavior, impacting the security and stability of the affected system.
What immediate steps should I take to mitigate this vulnerability?
Upgrade youki to version 0.5.7 or later, as this version contains the fix for the insufficiently strict write-target validation issue in apparmor handling.