CVE-2025-52565

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-52565
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-52565.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-52565
Aliases
Downstream
AZL (3)
BELL (1)
CGA (377)
CLSA (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (21)
OESA (1)
openSUSE (8)
RHBA (1)
RHSA (16)
RLSA (2)
SUSE (25)
UBUNTU (1)
Related
ALSA (3)
openSUSE (8)
SUSE (25)
Published
2025-11-06T20:02:58Z
Modified
2026-10-16T02:56:33Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
container escape due to /dev/console mount and related races
Details

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting /dev/pts/$n to /dev/console inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of /dev/pts/$n to /dev/console as configured for all containers that allocate a console). This happens after pivot_root(2), so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of /proc/sysrq-trigger or /proc/sys/kernel/core_pattern (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-363",
        "CWE-61"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52565.json"
}
References

Affected packages

Git / github.com/opencontainers/runc

Affected ranges

Type
GIT
Repo
https://github.com/opencontainers/runc
Events
Introduced
4144b63817ebcc5b358fc2c8ef95f7cddd709aa7
Fixed
eeb7e6024f9ee43876301b1d23c353384fa6dcdd
Introduced
4ca628d1d4c974f92d24daccb901aa078aad748e
Fixed
d842d7719497cc3b774fd71620278ac9e17710e0
Introduced
75f8da7c889acc4509a0cf6f0d3a8f9584778375
Fixed
01de9d65dc72f67b256ef03f9bfb795a2bf143b4
Fixed
398955bccb7f20565c224a3064d331c19e422398
Fixed
531ef794e4ecd628006a865ad334a048ee2b4b2e
Fixed
9be1dbf4ac67d9840a043ebd2df5c68f36705d1d
Fixed
aee7d3fe355dd02939d44155e308ea0052e0d53a
Fixed
db19bbed5348847da433faa9d69e9f90192bfa64
Fixed
de87203e625cd7a27141fb5f2ad00a320c69c5e8
Fixed
ff94f9991bd32076c871ef0ad8bc1b763458e480
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.1"
                },
                {
                    "fixed": "1.2.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.3.0"
                },
                {
                    "fixed": "1.3.3"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc3"
                },
                {
                    "last_affected": "1.0.0-rc3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc4"
                },
                {
                    "last_affected": "1.0.0-rc4"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc5"
                },
                {
                    "last_affected": "1.0.0-rc5"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc6"
                },
                {
                    "last_affected": "1.0.0-rc6"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc7"
                },
                {
                    "last_affected": "1.0.0-rc7"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc8"
                },
                {
                    "last_affected": "1.0.0-rc8"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc9"
                },
                {
                    "last_affected": "1.0.0-rc9"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc90:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc90"
                },
                {
                    "last_affected": "1.0.0-rc90"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc91:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc91"
                },
                {
                    "last_affected": "1.0.0-rc91"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc92:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc92"
                },
                {
                    "last_affected": "1.0.0-rc92"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc93:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc93"
                },
                {
                    "last_affected": "1.0.0-rc93"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc94:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc94"
                },
                {
                    "last_affected": "1.0.0-rc94"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc95:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.0.0-rc95"
                },
                {
                    "last_affected": "1.0.0-rc95"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "range": [
                {
                    "fixed": "01de9d65dc72f67b256ef03f9bfb795a2bf143b4"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "398955bccb7f20565c224a3064d331c19e422398"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "531ef794e4ecd628006a865ad334a048ee2b4b2e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "9be1dbf4ac67d9840a043ebd2df5c68f36705d1d"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "aee7d3fe355dd02939d44155e308ea0052e0d53a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "db19bbed5348847da433faa9d69e9f90192bfa64"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "de87203e625cd7a27141fb5f2ad00a320c69c5e8"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "ff94f9991bd32076c871ef0ad8bc1b763458e480"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.0.0-rc3
1.0.0-rc4
1.0.0-rc5
1.0.0-rc6
1.0.0-rc7
1.0.0-rc8
1.0.0-rc9
1.0.0-rc90
1.0.0-rc91
1.0.0-rc92
1.0.0-rc93
1.0.0-rc94
1.0.0-rc95

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-52565.json"