PT-2025-45375 · Runc+10 · Runc+10
Published
2025-11-04
·
Updated
2026-04-30
·
CVE-2025-52881
CVSS v3.1
7.5
High
| Vector | AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
runc version 1.2.7
runc version 1.3.2
runc version 1.4.0-rc.2
Description
runc is a CLI tool for spawning and running containers according to the OCI specification. A race condition exists that allows an attacker to trick the tool into misdirecting writes to
/proc to other procfs files. This is achieved by using a racing container with shared mounts, which can be triggered via symbolic links in a tmpfs or regular bind-mounts. This attack is also possible using a standard Dockerfile with docker buildx build as it permits parallel execution of containers with custom shared mounts. Exploitation of this issue can impact the confidentiality, integrity, and availability of protected information.Recommendations
Update runc version 1.2.7 to 1.2.8.
Update runc version 1.3.2 to 1.3.3.
Update runc version 1.4.0-rc.2 to 1.4.0-rc.3.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Runc