CVE-2025-52565
Vulnerability Summary
Timeline
Description
runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
CVSS Metrics
- v4.0•HIGH•Score: 8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
- v4.0•HIGH•Score: 8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v4.0•HIGH•Score: 7.3CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS Trends
Current EPSS score: 0.56%• Percentile: 46%
Techniques & Countermeasures
- CWE-61•UNIX Symbolic Link (Symlink) Following
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
- CWE-363•Race Condition Enabling Link Following
The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.
Affected Systems
- chainguard•azure-vnet-cni
< 1.7.4-r2
- chainguard•buildah
< 1.42.0-r1
- chainguard•cluster-autoscaler-1.31
< 1.31.5-r4 | < 1.31.5-r1
- chainguard•cluster-autoscaler-fips-1.31
< 1.31.5-r1 | < 1.31.5-r5
- chainguard•ctop
all
- chainguard•ctop-fips
all
- chainguard•eks-distro-1.29
< 1.29.53-r1
- chainguard•eks-distro-1.30
< 1.30.46-r1
- chainguard•eks-distro-1.31
< 1.31.35-r1
- chainguard•eks-distro-1.32
< 1.32.28-r1
- chainguard•eks-distro-coredns-1.30
< 1.30.46-r1
- chainguard•eks-distro-coredns-1.31
< 1.31.35-r1
- chainguard•eks-distro-coredns-1.32
< 1.32.28-r1
- chainguard•eks-distro-coredns-fips-1.29
< 1.29.53-r1
- chainguard•eks-distro-coredns-fips-1.30
< 1.30.46-r1
- chainguard•eks-distro-fips-1.29
< 1.29.53-r1
- chainguard•eks-distro-fips-1.30
< 1.30.46-r1
- chainguard•eks-distro-kube-apiserver-1.30
< 1.30.46-r1
- chainguard•eks-distro-kube-apiserver-1.31
< 1.31.35-r1
- chainguard•eks-distro-kube-apiserver-1.32
< 1.32.28-r1
- chainguard•eks-distro-kube-apiserver-fips-1.29
< 1.29.53-r1
- chainguard•eks-distro-kube-apiserver-fips-1.30
< 1.30.46-r1
- chainguard•eks-distro-kube-controller-manager-1.30
< 1.30.46-r1
- chainguard•eks-distro-kube-controller-manager-1.31
< 1.31.35-r1
- chainguard•eks-distro-kube-controller-manager-1.32
< 1.32.28-r1
- chainguard•eks-distro-kube-controller-manager-fips-1.29
< 1.29.53-r1
- chainguard•eks-distro-kube-controller-manager-fips-1.30
< 1.30.46-r1
- chainguard•eks-distro-kube-controller-manager-fips-1.32
< 1.32.28-r1
- chainguard•eks-distro-kube-proxy-1.30
< 1.30.46-r1
- chainguard•eks-distro-kube-proxy-1.31
< 1.31.35-r1
- chainguard•eks-distro-kube-proxy-fips-1.29
< 1.29.53-r1
- chainguard•eks-distro-kube-proxy-fips-1.30
< 1.30.46-r1
- chainguard•eks-distro-kube-proxy-fips-1.32
< 1.32.28-r1
- chainguard•eks-distro-kube-scheduler-1.30
< 1.30.46-r1
- chainguard•eks-distro-kube-scheduler-1.31
< 1.31.35-r1
- chainguard•eks-distro-kube-scheduler-1.32
< 1.32.28-r1
- chainguard•eks-distro-kube-scheduler-fips-1.29
< 1.29.53-r1
- chainguard•eks-distro-kube-scheduler-fips-1.30
< 1.30.46-r1
- chainguard•eks-distro-kubernetes-pause-1.30
< 1.30.46-r1
- chainguard•eks-distro-kubernetes-pause-1.31
< 1.31.35-r1
- chainguard•falco-no-driver
< 0.43.0-r0
- chainguard•gosu-1.11
all
- chainguard•grafana-alloy
< 1.11.3-r1
- chainguard•grafana-alloy-fips
< 1.11.3-r2
- chainguard•harvester-fips
< 0
- chainguard•harvester-fips-upgrade-helper
< 0
- chainguard•harvester-fips-webhook
< 0
- chainguard•harvester-upgrade-helper
< 0
- chainguard•harvester-webhook
< 0
- chainguard•k3s-1.32
< 1.32.9.1-r2
Showing first 50 affected entries in server-rendered view.
References (13)
- https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r
- https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4
- https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398
- https://github.com/opencontainers/runc/commit/531ef794e4ecd628006a865ad334a048ee2b4b2e
- https://github.com/opencontainers/runc/commit/9be1dbf4ac67d9840a043ebd2df5c68f36705d1d
- https://github.com/opencontainers/runc/commit/aee7d3fe355dd02939d44155e308ea0052e0d53a
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
- https://github.com/opencontainers/runc/commit/de87203e625cd7a27141fb5f2ad00a320c69c5e8
- https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480
- https://nvd.nist.gov/vuln/detail/CVE-2025-52565
- https://github.com/opencontainers/runc
- https://security-tracker.debian.org/tracker/CVE-2025-52565
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52565.json