CVE-2025-52565

Published Nov 6, 2025

Last updated 3 months ago

CVSS high 8.4

Container Security

Overview

Description: runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
Source: security-advisories@github.com
NVD status: Analyzed
Products: runc

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.4
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 6
Exploitability score: 0.8
Vector string: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-61

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3282BD30-4E57-4E14-980A-964ACD33820C",
            "versionEndExcluding": "1.2.8",
            "versionStartIncluding": "1.0.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F3193A96-E882-439B-984E-782315C62F69",
            "versionEndExcluding": "1.3.3",
            "versionStartIncluding": "1.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*",
            "matchCriteriaId": "3E580E25-F94C-4DA4-8718-15D5F1C3ADAF",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*",
            "matchCriteriaId": "FD565CE0-D9E9-4FD9-8998-8AC55030FAB7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*",
            "matchCriteriaId": "093326B1-448C-4E3B-886D-CAC8B6813BFF",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*",
            "matchCriteriaId": "F672C421-789D-4F21-B483-DA3EB251BA1D",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:*",
            "matchCriteriaId": "E13C190A-D7CE-4204-8CEF-B7317D3FFBF9",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:*",
            "matchCriteriaId": "15AEA3E2-A82F-4562-AFE6-B83A767B94E7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9:*:*:*:*:*:*",
            "matchCriteriaId": "EB5109FF-7C41-477E-B817-F63F06D866C3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc90:*:*:*:*:*:*",
            "matchCriteriaId": "B6B8085F-4B68-47E4-8B4B-FB8C2742EEF4",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc91:*:*:*:*:*:*",
            "matchCriteriaId": "978AFEA7-C64F-4B24-B314-4E0E7D5C521A",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc92:*:*:*:*:*:*",
            "matchCriteriaId": "A134E568-C11C-4D12-9B61-BFA58A080B96",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc93:*:*:*:*:*:*",
            "matchCriteriaId": "6FAC79BA-7A2A-45E3-8806-E2C812991ACC",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc94:*:*:*:*:*:*",
            "matchCriteriaId": "151570F5-F04B-4F31-AE6E-F364FC8AC01C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc95:*:*:*:*:*:*",
            "matchCriteriaId": "6208C863-487A-4343-B706-E84703C97116",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.4.0:rc1:*:*:*:*:*:*",
            "matchCriteriaId": "082E3496-822B-481B-AC2F-DA8DCAFC28FF",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:linuxfoundation:runc:1.4.0:rc2:*:*:*:*:*:*",
            "matchCriteriaId": "71C62E90-6357-44A4-B582-28B1F1D9B16D",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 4.0

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References