Container Misconfiguration Vulnerability in runc Tool by Open Containers Initiative
CVE-2025-52881
What is CVE-2025-52881?
The runc tool, designed to manage container lifecycle for OCI-compliant containers, faces a vulnerability that allows attackers to manipulate the expected behavior of the container's filesystem. This is achieved by creating a racing condition where writes intended for specific procfs files are redirected to others, potentially exposing sensitive data or leading to unintended side effects. This misdirection can be exploited using shared mounts and symbolic links in a tmpfs, leveraging Docker build configurations. The issue has been addressed in subsequent versions, ensuring that write operations adhere to strict checks for procfs file integrity.
Affected Version(s)
runc <= 1.2.7, < 1.2.8 < 1.2.7, 1.2.8
runc <= 1.3.2, < 1.3.3 < 1.3.2, 1.3.3
runc <= 1.4.0-rc.2, < 1.4.0-rc.3 < 1.4.0-rc.2, 1.4.0-rc.3