PT-2025-45773 · Crates.Io · Youki
Published
2025-11-05
·
Updated
2025-11-05
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H |
Impact
youki’s apparmor handling performs insufficiently strict write-target validation, which—combined with path substitution during pathname resolution—can allow writes to unintended procfs locations.
Weak write-target check
youki only verifies that the destination lies somewhere under procfs. As a result, a write intended for
/proc/self/attr/apparmor/exec can succeed even if the path has been redirected to /proc/sys/kernel/hostname(which is also in procfs).Path substitution
While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target.
This is a different project, but the core logic is similar to the CVE in runc. Issues were identified in runc, and verification was also conducted in youki to confirm the problems.
https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
Credits
Thanks to Li Fubang (@lifubang from acmcoder.com, CIIC) and Tõnis Tiigi (@tonistiigi from Docker) for both independently discovering runc's original vulnerability, as well as Aleksa Sarai (@cyphar from SUSE) for the original research into this class of security issues and solutions.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Youki