{"id":"CVE-2025-52565","published":"2025-11-06T20:02:58Z","modified":"2025-11-06T21:32:19Z","title":"container escape due to /dev/console mount and related races","vendor":"opencontainers","product":"runc","tier":"tail","description":{"text":"runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.4,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00811,"percentile":0.5691,"provenance":"source"},"cwes":[{"id":"CWE-61","name":"UNIX Symbolic Link (Symlink) Following"},{"id":"CWE-363","name":"Race Condition Enabling Link Following"}],"references":[{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencontainers/runc/commit/531ef794e4ecd628006a865ad334a048ee2b4b2e","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencontainers/runc/commit/9be1dbf4ac67d9840a043ebd2df5c68f36705d1d","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencontainers/runc/commit/aee7d3fe355dd02939d44155e308ea0052e0d53a","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencontainers/runc/commit/de87203e625cd7a27141fb5f2ad00a320c69c5e8","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480","tags":["x_refsource_MISC"]}],"priority":{"score":17.3,"factors":[{"name":"EPSS percentile","points":11.38},{"name":"CVSS severity","points":5.88}]},"vendorSlug":"opencontainers","affectedVersions":[{"vendor":"opencontainers","product":"runc","versions":[">= 1.0.0-rc3, < 1.2.8",">= 1.3.0-rc.1, < 1.3.3",">= 1.4.0-rc.1, < 1.4.0-rc.3"]}],"affected":[{"ecosystem":"Go","package":"github.com/opencontainers/runc","vulnerableRanges":[">=1.0.0-rc3, <1.2.8",">=1.3.0-rc.1, <1.3.3",">=1.4.0-rc.1, <1.4.0-rc.3"],"patched":["1.2.8","1.3.3","1.4.0-rc.3"],"from":["GHSA-qw9x-cqr3-wc7r","GO-2025-4097"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-37944","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencontainers-runc-cve-2016-9962","parents":[{"from":"CVE-2024-45310","to":"CVE-2025-52565","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.2.0-rc.3","toFixed":"1.2.8","daysApart":429},{"kind":"same-code","provenance":"machine","files":["libcontainer/system/linux.go"],"commits":["https://github.com/opencontainers/runc/commit/63c2908164f3a1daea455bf5bcd8d363d70328c7","https://github.com/opencontainers/runc/commit/8781993968fd964ac723ff5f360b6f259e809a3e","https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4","https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398"],"basis":"shared function","functions":["SetLinuxPersonality","createDeviceNode"]}]},{"from":"CVE-2021-30465","to":"CVE-2025-52565","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f","https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4","https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398"],"basis":"shared function","functions":["createDeviceNode","createDevices"]}]},{"from":"CVE-2025-31133","to":"CVE-2025-52565","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers tha…","from":"CVE.org","in":"CVE-2025-52565"},{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522","https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66","https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4","https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398"],"basis":"shared file"}]}],"children":[{"from":"CVE-2025-52565","to":"CVE-2025-52881","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-qw9x-cqr3-wc7r","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-cgrx-mc8f-2prm","via":"reference","url":"https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r"},{"kind":"osv-related","provenance":"source","id":"GO-2025-4098","via":"reference","url":"https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r"}]}],"packageHistory":[{"cve":"CVE-2024-21626","published":"2024-01-31","fixed":"1.1.12","kev":false},{"cve":"CVE-2024-45310","published":"2024-09-03","fixed":"1.2.0-rc.3","kev":false},{"cve":"CVE-2025-31133","published":"2025-11-06","fixed":"1.4.0-rc.3","kev":false},{"cve":"CVE-2025-52565","published":"2025-11-06","fixed":"1.4.0-rc.3","kev":false},{"cve":"CVE-2025-52881","published":"2025-11-06","fixed":"1.4.0-rc.3","kev":false},{"cve":"CVE-2026-41579","published":"2026-07-01","fixed":"1.5.0-rc.3","kev":false,"link":{"from":"CVE-2025-52565","to":"CVE-2026-41579","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.3.3","toFixed":"1.3.6","daysApart":237}]}}],"package":"Go:github.com/opencontainers/runc"}}