--- cve: "CVE-2025-52565" severity: "HIGH" cvss: 8.4 epss: "57%" vendor: "opencontainers" kev: false exploited: false published: "2025-11-06 20:15:49" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-09-13T07:06:35+02:00" --- # CVE-2025-52565 > 8.4 HIGH · 🧪 PoC ## Beschreibung runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3. ## CVSS-Vektor ``` CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Lokal | good | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | ## Patch verfügbar (OSV) - eeb7e6024f9ee43876301b1d23c353384fa6dcdd (Commit) - d842d7719497cc3b774fd71620278ac9e17710e0 (Commit) ## Referenzen - - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-52565) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_