CVE-2025-52565

Aliases:GHSA-qw9x-cqr3-wc7rGO-2025-4097
Advisory lineage Upstream: 0 Downstream: 46
Analyzed
Published: 06 Nov 2025, 20:02
Last modified:06 Nov 2025, 21:32

Vulnerability Summary

Overall Risk (default)
medium
44/100
CVSS Score
8.4 HIGH
v4.0 (cve.org)
EPSS Score
0.03% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

06 Nov 2025, 20:02
Published
Vulnerability first disclosed
06 Nov 2025, 21:32
Last Modified
Vulnerability information updated

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

CVSS Metrics

  • v4.0•HIGH•Score: 8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
  • v4.0•HIGH•Score: 8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v4.0•HIGH•Score: 7.3CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.03%• Percentile: 8%

Techniques & Countermeasures

  • CWE-61•UNIX Symbolic Link (Symlink) Following

    The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

  • CWE-363•Race Condition Enabling Link Following

    The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

Affected Systems

  • github.com/opencontainers•runc

    ≥ 1.0.0-rc3, < 1.2.8 | ≥ 1.3.0-rc.1, < 1.3.3 | ≥ 1.4.0-rc.1, < 1.4.0-rc.3

  • linuxfoundation•runc

    ≥ 1.0.1, < 1.2.8 | ≥ 1.3.0, < 1.3.3 | 1.0.0:rc3 | 1.0.0:rc4 | 1.0.0:rc5 | 1.0.0:rc6 | 1.0.0:rc7 | 1.0.0:rc8 | 1.0.0:rc9 | 1.0.0:rc90 | 1.0.0:rc91 | 1.0.0:rc92 | 1.0.0:rc93 | 1.0.0:rc94 | 1.0.0:rc95 | 1.4.0:rc1 | 1.4.0:rc2

  • opencontainers•runc

    ≥ 1.0.0-rc3, < 1.2.8 | ≥ 1.3.0-rc.1, < 1.3.3 | ≥ 1.4.0-rc.1, < 1.4.0-rc.3

References (11)