CVE-2025-52565

Publication date 5 November 2025

Last updated 12 November 2025

Ubuntu priority

High

Why this priority?

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

Read the notes from the security team

Why is this CVE high priority?

runc developers have rated this as being high severity

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
runc 25.10 questing Ignored backport too intrusive
25.04 plucky Ignored backport too intrusive
24.04 LTS noble Ignored backport too intrusive
22.04 LTS jammy Ignored backport too intrusive
20.04 LTS focal Ignored backport too intrusive
18.04 LTS bionic Ignored backport too intrusive
16.04 LTS xenial Ignored backport too intrusive
runc-app 25.10 questing
Fixed 1.3.3-0ubuntu1~25.10.2
25.04 plucky
Fixed 1.3.3-0ubuntu1~25.04.2
24.04 LTS noble
Fixed 1.3.3-0ubuntu1~24.04.2
22.04 LTS jammy
Fixed 1.3.3-0ubuntu1~22.04.2
20.04 LTS focal Ignored backport too intrusive
runc-stable 25.10 questing
Fixed 1.3.3-0ubuntu1~25.10.2
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
20.04 LTS focal Not in release
18.04 LTS bionic Not in release
16.04 LTS xenial Not in release
14.04 LTS trusty Not in release

Notes

sbeattie

src:runc-app provides the runc binaries, src:runc provides golang-github-opencontainers-runc-dev in older releases. See LP: #2022390 and LP: #2040460 for details.

References

Related Ubuntu Security Notices (USN)

Other references