CVE-2025-52881

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

CVSS Metrics

• v4.0•HIGH•Score: 7.3CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
• v4.0•HIGH•Score: 7.3CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
• v3.1•HIGH•Score: 8.2CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.56%• Percentile: 46%

Techniques & Countermeasures

• CWE-61•UNIX Symbolic Link (Symlink) Following

  The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

• CWE-363•Race Condition Enabling Link Following

  The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

Affected Systems

• chainguard•amazon-k8s-cni-fips

  < 1.20.4-r3

• chainguard•amazon-k8s-cni-init-fips

  < 1.20.4-r3

• chainguard•amazon-k8s-cni-init-fips-compat

  < 1.20.4-r3

• chainguard•azure-container-networking

  < 1.7.4-r3

• chainguard•azure-vnet-cni

  < 1.7.4-r3

• chainguard•blob-csi-1.23

  < 1.23.11-r57

• chainguard•blob-csi-1.23-compat

  < 1.23.11-r57

• chainguard•blob-csi-1.24

  < 1.24.11-r6

• chainguard•blob-csi-1.24-compat

  < 1.24.11-r6

• chainguard•blob-csi-1.25

  < 1.25.10-r2

• chainguard•blob-csi-1.25-compat

  < 1.25.10-r2

• chainguard•blob-csi-1.26

  < 1.26.7-r5

• chainguard•blob-csi-1.26-compat

  < 1.26.7-r5

• chainguard•blob-csi-fips-1.23

  < 1.23.11-r58

• chainguard•blob-csi-fips-1.23-compat

  < 1.23.11-r58

• chainguard•blob-csi-fips-1.24

  < 1.24.11-r6

• chainguard•blob-csi-fips-1.24-compat

  < 1.24.11-r6

• chainguard•buildah

  < 1.42.2-r0 | < 1.42.1-r0

• chainguard•cg

  < 0.2.174-r0

• chainguard•chainctl

  < 0.2.174-r0

• chainguard•checksec

  < 3.0.2-r7

• chainguard•cloudbeat-fips-9.2

  < 9.2.0-r2

• chainguard•cluster-autoscaler-1.31

  < 1.31.5-r1 | < 1.31.5-r4

• chainguard•cluster-autoscaler-fips-1.31

  < 1.31.5-r1 | < 1.31.5-r5

• chainguard•cni-plugins-fips

  < 1.8.0-r2

• chainguard•cni-plugins-fips-bandwidth

  < 1.8.0-r2

• chainguard•cni-plugins-fips-bandwidth-compat

  < 1.8.0-r2

• chainguard•cni-plugins-fips-bridge

  < 1.8.0-r2

• chainguard•cni-plugins-fips-bridge-compat

  < 1.8.0-r2

• chainguard•cni-plugins-fips-dhcp

  < 1.8.0-r2

• chainguard•cni-plugins-fips-dhcp-compat

  < 1.8.0-r2

• chainguard•cni-plugins-fips-dummy

  < 1.8.0-r2

• chainguard•cni-plugins-fips-dummy-compat

  < 1.8.0-r2

• chainguard•cni-plugins-fips-firewall

  < 1.8.0-r2

• chainguard•cni-plugins-fips-firewall-compat

  < 1.8.0-r2

• chainguard•cni-plugins-fips-host-device

  < 1.8.0-r2

• chainguard•cni-plugins-fips-host-device-compat

  < 1.8.0-r2

• chainguard•cni-plugins-fips-host-local

  < 1.8.0-r2

• chainguard•cni-plugins-fips-host-local-compat

  < 1.8.0-r2

• chainguard•cni-plugins-fips-ipam

  < 1.8.0-r2

• chainguard•cni-plugins-fips-ipvlan

  < 1.8.0-r2

• chainguard•cni-plugins-fips-ipvlan-compat

  < 1.8.0-r2

• chainguard•cni-plugins-fips-loopback

  < 1.8.0-r2

• chainguard•cni-plugins-fips-loopback-compat

  < 1.8.0-r2

• chainguard•cni-plugins-fips-macvlan

  < 1.8.0-r2

• chainguard•cni-plugins-fips-macvlan-compat

  < 1.8.0-r2

• chainguard•cni-plugins-fips-main

  < 1.8.0-r2

• chainguard•cni-plugins-fips-meta

  < 1.8.0-r2

• chainguard•cni-plugins-fips-portmap

  < 1.8.0-r2

• chainguard•cni-plugins-fips-portmap-compat

  < 1.8.0-r2

Showing first 50 affected entries in server-rendered view.

References (49)

• https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
• https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r
• https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
• https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480
• https://github.com/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51
• https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1
• https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
• https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165
• https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2
• https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28
• https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db
• https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544
• https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f
• https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6
• https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58
• https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d
• https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557
• https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md
• http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
• http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
• https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw
• https://nvd.nist.gov/vuln/detail/CVE-2025-52881
• https://github.com/opencontainers/selinux/pull/237
• https://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
• https://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
• https://youtu.be/tGseJW_uBB8
• https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs
• https://youtu.be/y1PaBzxwRWQ
• https://github.com/opencontainers/selinux/releases/tag/v1.13.0
• https://github.com/opencontainers/runc
• https://access.redhat.com/errata/RHSA-2025:21220
• https://access.redhat.com/security/updates/classification/#important
• https://bugzilla.redhat.com/show_bug.cgi?id=2404715
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21220.json
• https://access.redhat.com/security/cve/CVE-2025-52881
• https://www.cve.org/CVERecord?id=CVE-2025-52881
• https://access.redhat.com/errata/RHSA-2025:21633
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21633.json
• https://access.redhat.com/errata/RHSA-2025:21634
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21634.json
• https://access.redhat.com/errata/RHSA-2025:21702
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21702.json
• https://access.redhat.com/errata/RHSA-2025:23543
• https://issues.redhat.com/browse/RHEL-132831
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23543.json
• https://access.redhat.com/errata/RHSA-2026:2975
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2975.json
• https://security-tracker.debian.org/tracker/CVE-2025-52881
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52881.json