Skip to main content

Runc CVE-2025-52565

HIGH
UNIX Symbolic Link (Symlink) Following (CWE-61)
2025-11-06 security-advisories@github.com
Denial Of Service Runc Red Hat Suse
8.4
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.5 HIGH
AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Red Hat
8.2 HIGH
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

4
Analysis Generated
Mar 28, 2026 - 19:20 vuln.today
Patch released
Mar 28, 2026 - 19:20 nvd
Patch available
PoC Detected
Dec 03, 2025 - 18:33 vuln.today
Public exploit code
CVE Published
Nov 06, 2025 - 20:15 nvd
HIGH 8.4

DescriptionGitHub Advisory

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting /dev/pts/$n to /dev/console inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of /dev/pts/$n to /dev/console as configured for all containers that allocate a console). This happens after pivot_root(2), so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of /proc/sysrq-trigger or /proc/sys/kernel/core_pattern (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

AnalysisAI

runc is a CLI tool for spawning and running containers according to the OCI specification. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-61. runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting /dev/pts/$n to /dev/console inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of /dev/pts/$n to /dev/console as configured for all containers that allocate a console). This happens after pivot_root(2), so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of /proc/sysrq-trigger or /proc/sys/kernel/core_pattern (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3. Affected products include: Linuxfoundation Runc. Version information: through 1.2.7.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Runc

View all
CVE-2024-21626 HIGH POC
8.6

Alpine Linux: runc fixed in 1.1.12-r0
CVE-2019-16884 HIGH POC
7.5 Sep 25

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass beca
CVE-2025-52881 HIGH POC
7.3 Nov 06

runc is a CLI tool for spawning and running containers according to the OCI specification. Rated high severity (CVSS 7.3
CVE-2025-31133 HIGH POC
7.3 Nov 06

runc is a CLI tool for spawning and running containers according to the OCI specification. Rated high severity (CVSS 7.3
CVE-2023-27561 HIGH POC
7.0 Mar 03

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linu
CVE-2023-25809 MEDIUM POC
6.3 Mar 29

runc is a CLI tool for spawning and running containers according to the OCI specification. Rated medium severity (CVSS 6
CVE-2021-43784 MEDIUM POC
5.0 Dec 06

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. Rated medium severit
CVE-2021-30465 HIGH
8.5 May 27

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. Rated high severity (CVSS 8.5), t
CVE-2016-3697 HIGH
7.8 Jun 01

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a po
CVE-2023-28642 HIGH
7.8 Mar 29

runc is a CLI tool for spawning and running containers according to the OCI specification. Rated high severity (CVSS 7.8
CVE-2022-29162 HIGH
7.8 May 17

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. Rated high severity

CVE-2022-24769 MEDIUM
5.9 Mar 24

Moby is an open-source project created by Docker to enable and accelerate software containerization. Rated medium severi

Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following

View all
CVE-2026-54420 HIGH POC
8.5
CVE-2026-27976 HIGH POC
8.8
CVE-2024-22014 HIGH POC
8.8
CVE-2026-39860 HIGH POC
8.4
CVE-2026-54574 HIGH POC
8.2
CVE-2026-41326 HIGH POC
8.2
CVE-2025-1079 HIGH POC
7.8
CVE-2021-25321 HIGH POC
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.99 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-5.7 Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.29 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.0-4.57 Affected

Share

CVE-2025-52565 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy