CVE-2025-52565
Description
runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
How to fix
- linuxfoundation runc1.2.8, 1.3.3 or later
- github.com/opencontainers/runc1.2.8, 1.3.3, 1.4.0-rc.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation runc | 1.0.1 ≤ v < 1.2.8, 1.3.0 ≤ v < 1.3.3, 1.0.0, 1.4.0 | 1.2.8, 1.3.3 |
| github.com/opencontainers/runcGo | 1.0.0-rc3 ≤ v < 1.2.8, 1.3.0-rc.1 ≤ v < 1.3.3, 1.4.0-rc.1 ≤ v < 1.4.0-rc.3 | 1.2.8, 1.3.3, 1.4.0-rc.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.