PT-2025-13547 · Google+1 · Google Gvisor+1

Alex Ridevski + 1 · Published 2025-03-28 · Updated 2025-09-08 · CVE-2025-2713

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google gVisor (affected versions not specified)

Description The issue is related to a local privilege escalation due to incorrect handling of file access permissions in Google gVisor's runsc component. This allowed unprivileged users to access restricted files because the process initially ran with root-like permissions until the first fork.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Privilege Management

Incorrect Privilege Assignment

Weakness Enumeration

CWE-269

CWE-266

Related Identifiers

CVE-2025-2713

Affected Products

Debian

Google Gvisor

References · 13

• https://github.com/google/gvisor/commit/586c38d70081b13b2ed494cef48e99b93956843e · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-2713 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2713 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-2713 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-2713 · Security Note
• https://ubuntu.com/security/CVE-2025-2713 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2713 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2713 · Vendor Advisory
• https://twitter.com/CVEnew/status/1905674313879126383 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1905660516766294450 · Twitter Post
• https://t.me/cvetracker/20203 · Telegram Post
• https://t.me/cveNotify/134607 · Telegram Post
• https://t.me/cvedetector/21433 · Telegram Post