8.4

CVE-2025-52565: container escape due to /dev/console mount and related races

Analyzed
AliasesUBUNTU-CVE-2025-52565DEBIAN-CVE-2025-52565CGA-29hm-3g7q-fg99
Published 06-11-2025Last modified 06-11-2025

Vulnerability summary

CVE-2025-52565 is a high (CVSS 8.4) UNIX Symbolic Link (Symlink) Following vulnerability in linuxfoundation runc. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56.9% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
8.4/10
010
High · v4.0 (CVE.org)
EPSS score
0.81%
0%100%
Low · +0.25 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 51 · Related 44
MGASA-2025-0271OPENSUSE-SU-2025:15705-1OPENSUSE-SU-2025:20072-1OPENSUSE-SU-2026:20072-1OPENSUSE-SU-2026:20080-1OPENSUSE-SU-2026:20140-1

Timeline

  1. 06-11-2025
    PublishedVulnerability first disclosed.
  2. 06-11-2025
    Last modifiedVulnerability information updated.

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

CVSS metrics

10 scores · 8 sources · 2 versions

EPSS trend

Probability

0.81%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

Increase +0.25 pp

From 0.56% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Runc

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard121 products
  • azure-vnet-cni< 1.7.4-r2
  • buildah< 1.42.0-r1
  • cluster-autoscaler-1.31< 1.31.5-r4 | < 1.31.5-r1
  • cluster-autoscaler-fips-1.31< 1.31.5-r1 | < 1.31.5-r5
  • ctopAll versions (No fix recorded)
Wolfi21 products
  • buildah< 1.42.0-r1
  • ctopAll versions (No fix recorded)
  • docker-machine-driver-harvesterAll versions (No fix recorded)
  • falco-no-driver< 0.43.0-r0
  • grafana-alloy< 1.11.3-r1
Ubuntu3 products
  • runcAll versions (No fix recorded)
  • runc-appAll versions (No fix recorded) | < 1.3.3-0ubuntu1~22.04.2 | < 1.3.3-0ubuntu1~24.04.2 | < 1.3.3-0ubuntu1~25.10.2
  • runc-stable< 1.3.3-0ubuntu1~25.10.2
Alpine1 product
  • runc≥ 1.0.1, < 1.3.3-r0
Debian1 product
  • runcAll versions (No fix recorded) | < 1.3.3+ds1-2
Github.com/opencontainers1 product
  • runc≥ 1.0.0-rc3, < 1.2.8 | ≥ 1.3.0-rc.1, < 1.3.3 | ≥ 1.4.0-rc.1, < 1.4.0-rc.3
Linuxfoundation1 product
  • runc≥ 1.0.1, < 1.2.8 | ≥ 1.3.0, < 1.3.3 | 1.0.0:rc3 | 1.0.0:rc4 | 1.0.0:rc5 | 1.0.0:rc6 | 1.0.0:rc7 | 1.0.0:rc8 | 1.0.0:rc9 | 1.0.0:rc90 | 1.0.0:rc91 | 1.0.0:rc92 | 1.0.0:rc93 | 1.0.0:rc94 | 1.0.0:rc95 | 1.4.0:rc1 | 1.4.0:rc2
Opencontainers1 product
  • runc≥ 1.0.0-rc3, < 1.2.8 | ≥ 1.3.0-rc.1, < 1.3.3 | ≥ 1.4.0-rc.1, < 1.4.0-rc.3

8 vendors · 150 products

References

17 links
Show all 17 references