UNIX symbolic link following in runc - CVE-2025-52565

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU118106

UNIX symbolic link following in runc - CVE-2025-52565

Published: November 5, 2025


Vulnerability identifier: #VU118106
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-52565
CWE-ID: CWE-61
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue related to /dev/console mounts. A local user can escape the container using a malicious config and escalate privileges on the system.


Affected software

runc
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Containers Module
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Fedora
Arista Extensible Operating System (EOS)
Arista CloudEOS VM
buildah
Red Hat OpenShift Container Platform
Maximo Application Suite - IoT Component
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
toolbox
toolbox-tests
udica
python-eventlet (Red Hat package)
docker-runc
slirp4netns
runc
runc (Red Hat package)
runc-debuginfo
oci-seccomp-bpf-hook
runc-app (Ubuntu package)
containernetworking-plugins
aardvark-dns
netavark
alloy
alloy-debuginfo
fuse-overlayfs
crun (Red Hat package)
crun
skopeo-tests
skopeo
cri-o (Red Hat package)
buildah
buildah-tests
containers-common
conmon
haproxy (Red Hat package)
container-selinux
criu-libs
criu-devel
criu
python3-criu
crit
libslirp-devel
libslirp
python3-podman
podman (Red Hat package)
podman-plugins
podman
podman-catatonit
podman-gvproxy
podman-remote
podman-tests
podman-docker
podman-debuginfo
podmansh
podman-remote-debuginfo
kernel (Red Hat package)
kernel-rt (Red Hat package)
cockpit-podman
AI Inference Server
AI Inference Server Model Optimization Tools

How to mitigate CVE-2025-52565

Install updates from vendor's website.

runc - addressed in versions 1.2.8, 1.3.3, 1.4.0 rc.3
buildah - update to 1.33.14
Maximo Application Suite - IoT Component - addressed in versions 8.7.29, 8.8.25, 9.0.15, 9.1.6
toolbox - update to 0.0.99.5-2.0.1
toolbox-tests - update to 0.0.99.5-2.0.1
udica - update to 0.2.6-21
python-eventlet (Red Hat package) - update to 0.33.1-7.el9
docker-runc - update to 1.0.0 rc3-229
slirp4netns - update to 1.2.3-1
runc - update to 1.2.5-2
runc (Red Hat package) - addressed in versions 1.2.5-3.el9_6, 1.2.9-1.el9_0, 1.2.9-1.el9_2.1, 1.2.9-1.rhaos4.16.el8, 1.2.9-1.rhaos4.16.el9, 1.2.9-1.rhaos4.17.el8, 1.2.9-1.rhaos4.17.el9, 1.2.9-1.rhaos4.18.el8, 1.2.9-1.rhaos4.18.el9, 1.3.0-4.el9_7
runc - addressed in versions 1.2.7-16.67.1, 1.2.7-150000.80.1, 1.3.3-16.70.1, 1.3.3-150000.85.1
runc-debuginfo - addressed in versions 1.2.7-16.67.1, 1.2.7-150000.80.1, 1.3.3-16.70.1, 1.3.3-150000.85.1
oci-seccomp-bpf-hook - update to 1.2.10-1
runc-app (Ubuntu package) - addressed in versions 1.3.3-0ubuntu1~22.04.2, 1.3.3-0ubuntu1~22.04.3, 1.3.3-0ubuntu1~24.04.2, 1.3.3-0ubuntu1~24.04.3, 1.3.3-0ubuntu1~25.04.2, 1.3.3-0ubuntu1~25.04.3, 1.3.3-0ubuntu1~25.10.2, 1.3.3-0ubuntu1~25.10.3
runc - update to 1.3.3-1.fc44
containernetworking-plugins - update to 1.4.0-6.0.1
aardvark-dns - update to 1.10.1-2.0.1
netavark - update to 1.10.3-1.0.1
alloy - update to 1.12.2-150700.15.15.1
alloy-debuginfo - update to 1.12.2-150700.15.15.1
fuse-overlayfs - update to 1.13-1.0.1
crun (Red Hat package) - update to 1.14.3-1.el9_0
crun - update to 1.14.3-2
skopeo-tests - update to 1.14.5-4.0.1
skopeo - update to 1.14.5-4.0.1
cri-o (Red Hat package) - addressed in versions 1.25.5-32.rhaos4.12.git6120b13.el8, 1.29.13-11.rhaos4.16.git979a5e6.el8, 1.29.13-11.rhaos4.16.git979a5e6.el9, 1.31.13-3.rhaos4.18.gite0b87e5.el8, 1.31.13-3.rhaos4.18.gite0b87e5.el9
buildah - update to 1.33.12-2
buildah-tests - update to 1.33.12-2
containers-common - update to 1-82.0.1
conmon - update to 2.1.10-1
haproxy (Red Hat package) - update to 2.8.10-2.rhaos4.18.el9
container-selinux - update to 2.229.0-2
AI Inference Server - update to 3.2.5
AI Inference Server Model Optimization Tools - update to 3.2.5
criu-libs - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
python3-criu - update to 3.18-5.0.1
crit - update to 3.18-5.0.1
libslirp-devel - update to 4.4.0-2
libslirp - update to 4.4.0-2
python3-podman - update to 4.9.0-3
podman (Red Hat package) - addressed in versions 4.9.4-19.rhaos4.16.el8, 4.9.4-20.rhaos4.16.el9, 5.2.2-6.rhaos4.18.el8, 5.2.2-12.rhaos4.17.el8, 5.2.2-12.rhaos4.17.el9, 5.2.2-14.rhaos4.18.el9
podman-plugins - update to 4.9.4-23.0.1
podman - update to 4.9.4-23.0.1
podman-catatonit - update to 4.9.4-23.0.1
podman-gvproxy - update to 4.9.4-23.0.1
podman-remote - update to 4.9.4-23.0.1
podman-tests - update to 4.9.4-23.0.1
podman-docker - update to 4.9.4-23.0.1
podman - addressed in versions 4.9.5-150300.9.63.2, 4.9.5-150400.4.59.2, 4.9.5-150500.3.56.2
podman-debuginfo - addressed in versions 4.9.5-150300.9.63.2, 4.9.5-150400.4.59.2, 4.9.5-150500.3.56.2
podman-docker - addressed in versions 4.9.5-150300.9.63.2, 4.9.5-150400.4.59.2, 4.9.5-150500.3.56.2
podman-remote - addressed in versions 4.9.5-150300.9.63.2, 4.9.5-150400.4.59.2, 4.9.5-150500.3.56.2
podmansh - addressed in versions 4.9.5-150300.9.63.2, 4.9.5-150400.4.59.2, 4.9.5-150500.3.56.2
podman-remote-debuginfo - addressed in versions 4.9.5-150300.9.63.2, 4.9.5-150400.4.59.2, 4.9.5-150500.3.56.2
Red Hat OpenShift Container Platform - addressed in versions 4.12.84, 4.12.87, 4.13.62, 4.13.63, 4.14.61, 4.15.60, 4.15.61, 4.16.53, 4.16.55, 4.17.47, 4.18.29, 4.18.31
kernel (Red Hat package) - addressed in versions 4.18.0-372.175.1.el8_6, 5.14.0-284.153.1.el9_2, 5.14.0-284.154.1.el9_2, 5.14.0-284.155.1.el9_2, 5.14.0-427.105.1.el9_4, 5.14.0-427.107.1.el9_4
Arista Extensible Operating System (EOS) - addressed in versions 4.32.9M, 4.34.5M, 4.35.3F
Arista CloudEOS VM - addressed in versions 4.32.9M, 4.34.5M, 4.35.3F
kernel-rt (Red Hat package) - addressed in versions 5.14.0-284.153.1.rt14.438.el9_2, 5.14.0-284.154.1.rt14.439.el9_2, 5.14.0-284.155.1.rt14.440.el9_2
cockpit-podman - update to 84.1-1

External References

Related Security Bulletins