{"id":"CVE-2025-62596","published":"2025-11-05T23:14:37Z","modified":"2025-11-06T16:54:15Z","title":"youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects","vendor":"youki-dev","product":"youki","tier":"tail","description":{"text":"Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.3,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00267,"percentile":0.18854,"provenance":"source"},"cwes":[{"id":"CWE-61","name":"UNIX Symbolic Link (Symlink) Following"},{"id":"CWE-363","name":"Race Condition Enabling Link Following"}],"references":[{"url":"https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a","tags":["x_refsource_MISC"]},{"url":"https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs","tags":["x_refsource_MISC"]},{"url":"https://youtu.be/tGseJW_uBB8","tags":["x_refsource_MISC"]},{"url":"https://youtu.be/y1PaBzxwRWQ","tags":["x_refsource_MISC"]}],"priority":{"score":8.9,"factors":[{"name":"EPSS percentile","points":3.77},{"name":"CVSS severity","points":5.11}]},"vendorSlug":"youki-dev","affectedVersions":[{"vendor":"youki-dev","product":"youki","versions":["< 0.5.7"]}],"affected":[{"ecosystem":"crates.io","package":"youki","vulnerableRanges":["<0.5.7"],"patched":["0.5.7"],"from":["GHSA-vf95-55w6-qmrf"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-37938","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencontainers-runc-cve-2016-9962","children":[{"from":"CVE-2025-62596","to":"CVE-2025-52881","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-vf95-55w6-qmrf","via":"reference","url":"https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm"}]}],"packageHistory":[{"cve":"CVE-2025-54867","published":"2025-08-14","fixed":"0.5.5","kev":false,"link":{"from":"CVE-2025-54867","to":"CVE-2025-62596","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"crates.io:youki","fromFixed":"0.5.5","toFixed":"0.5.7","daysApart":83},{"kind":"similar","provenance":"machine","score":0.36,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2025-62161","published":"2025-11-05","fixed":"0.5.7","kev":false},{"cve":"CVE-2025-62596","published":"2025-11-05","fixed":"0.5.7","kev":false}],"package":"crates.io:youki"}}