7.5 CVE-2025-52881
Enriched by CISA Patch Exploit
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
https://nvd.nist.gov/vuln/detail/CVE-2025-52881
Categories
CWE-61 : UNIX Symbolic Link (Symlink) Following
A product that allows UNIX symbolic links (symlink) as part of paths whether in internal code or through user input can allow an attacker to spoof the symbolic link and traverse the file system to unintended locations or access arbitrary files. The symbolic link can permit an attacker to read/write/corrupt a file that they originally did not have permissions to access.
References
security-advisories@github.com Patch Exploit
AFFECTED (from MITRE)
| Vendor | Product | Versions |
|---|---|---|
| opencontainers | runc | |
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. | ||
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* | < 1.2.8 | |
| cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* | >= 1.3.0 | < 1.3.3 |
| cpe:2.3:a:linuxfoundation:runc:1.4.0:rc1:*:*:*:*:*:* | ||
| cpe:2.3:a:linuxfoundation:runc:1.4.0:rc2:*:*:*:*:*:* | ||
REMEDIATION
Patch
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| No known exploits |
Other Nist (github, ...)
| Url |
|---|
| https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| 27 | Leveraging Race Conditions via Symbolic Links |
High |
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
