Vulnerability Description
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Runc | < 1.2.8 |
Related Weaknesses (CWE)
References
- http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e28014496Patch
- http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ePatch
- https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.mdPatch
- https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0Patch
- https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2Patch
- https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5Patch
- https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5bPatch
- https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe0Patch
- https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2Patch
- https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568efPatch
- https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624Patch
- https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fPatch
- https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2Patch
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f9019Patch
- https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdaPatch
FAQ
What is CVE-2025-52881?
CVE-2025-52881 is a vulnerability with a CVSS score of 7.5 (HIGH). runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to othe...
How severe is CVE-2025-52881?
CVE-2025-52881 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-52881?
Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Runc.