PT-2025-13547 · Google+1 · Google Gvisor+1

Alex Ridevski + 1 · CVE-2025-2713 · Published 2025-03-28 · Updated 2025-09-08

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google gVisor (affected versions not specified)

Description The issue is related to a local privilege escalation due to incorrect handling of file access permissions in Google gVisor's runsc component. This allowed unprivileged users to access restricted files because the process initially ran with root-like permissions until the first fork.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Improper Privilege Management

Incorrect Privilege Assignment

Weakness Enumeration

CWE-269

CWE-266

Related Identifiers

CVE-2025-2713

Affected Products

Debian

Google Gvisor

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2713.json · Exploit
• https://github.com/google/gvisor/commit/586c38d70081b13b2ed494cef48e99b93956843e · Patch
• https://cve.org/CVERecord?id=CVE-2025-2713 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2713 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2713 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-2713 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-2713 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2713 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2713 · Vendor Advisory
• https://github.com/google/gvisor · Note
• https://twitter.com/WolfgangSesin/status/1905660516766294450 · Twitter Post
• https://t.me/cveNotify/134607 · Telegram Post
• https://t.me/cvedetector/21433 · Telegram Post
• https://twitter.com/CVEnew/status/1905674313879126383 · Twitter Post
• https://t.me/cvetracker/20203 · Telegram Post