CVE-2025-52881 runc: LSM labels can be bypassed with malicious config using dummy procfs files
Attackers can bypass LSM security labels in runc by misdirecting procfs writes via race conditions, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-52881?
CVE-2025-52881 is a high-severity vulnerability in opencontainers runc, published on 6 Nov 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
Which versions are affected by CVE-2025-52881?
10 open source packages ship an affected version, including github.com/opencontainers/runc and github.com/opencontainers/selinux. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/opencontainers/runc Go | All versions | 1.2.8, 1.3.3, 1.4.0-rc.3 |
github.com/opencontainers/runc Go | All versions | 1.2.8 |
github.com/opencontainers/runc Go | All versions | 1.2.8 |
github.com/opencontainers/runc Go | From 1.3.0-rc.1 | 1.3.3 |
github.com/opencontainers/runc Go | From 1.3.0-rc.1 | 1.3.3 |
github.com/opencontainers/runc Go | From 1.4.0-rc.1 | 1.4.0-rc.3 |
4 more packages
github.com/opencontainers/runc Go | From 1.4.0-rc.1 | 1.4.0-rc.3 |
github.com/opencontainers/selinux Go | All versions | 1.13.0 |
github.com/opencontainers/selinux Go | All versions | 1.13.0 |
github.com/opencontainers/selinux Go | All versions | 1.13.0 |
Linux distribution packages (30)
podman-docker AlmaLinux:10 | All versions | 7:5.6.0-6.el10_1 |
aardvark-dns AlmaLinux:8 | All versions | 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 |
aardvark-dns AlmaLinux:8 | All versions | 2:1.10.1-2.module_el8.10.0+4023+db236c53 |
aardvark-dns AlmaLinux:8 | All versions | 2:1.10.1-2.module_el8.10.0+4047+545787c4 |
aardvark-dns AlmaLinux:8 | All versions | 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe |
buildah AlmaLinux:8 | All versions | 2:1.33.13-1.module_el8.10.0+4082+f7f0c95e |
buildah AlmaLinux:8 | All versions | 2:1.33.13-1.module_el8.10.0+4089+ce72bbbe |
buildah-tests AlmaLinux:8 | All versions | 2:1.33.13-1.module_el8.10.0+4089+ce72bbbe |
cockpit-podman AlmaLinux:8 | All versions | 84.1-1.module_el8.10.0+4016+efd18bf8 |
conmon AlmaLinux:8 | All versions | 3:2.1.10-1.module_el8.10.0+3970+8445edf6 |
conmon AlmaLinux:8 | All versions | 3:2.1.10-1.module_el8.10.0+4068+0e21408f |
container-selinux AlmaLinux:8 | All versions | 2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7 |
containernetworking-plugins AlmaLinux:8 | All versions | 1:1.4.0-6.module_el8.10.0+4016+efd18bf8 |
containernetworking-plugins AlmaLinux:8 | All versions | 1:1.4.0-6.module_el8.10.0+4047+545787c4 |
containernetworking-plugins AlmaLinux:8 | All versions | 1:1.4.0-6.module_el8.10.0+4068+0e21408f |
containers-common AlmaLinux:8 | All versions | 2:1-82.module_el8.10.0+3876+e55593a8 |
containers-common AlmaLinux:8 | All versions | 2:1-82.module_el8.10.0+3901+4b80ecd7 |
containers-common AlmaLinux:8 | All versions | 2:1-82.module_el8.10.0+4047+545787c4 |
containers-common AlmaLinux:8 | All versions | 2:1-82.module_el8.10.0+4089+ce72bbbe |
crit AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3845+87b84552 |
crit AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3858+6ad51f9f |
crit AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3901+4b80ecd7 |
crit AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+4068+0e21408f |
criu AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3876+e55593a8 |
criu AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3909+6e1c1eb7 |
criu AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3926+f12484f5 |
criu AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+4089+ce72bbbe |
criu-devel AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+3858+6ad51f9f |
criu-devel AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+4016+efd18bf8 |
criu-devel AlmaLinux:8 | All versions | 3.18-5.module_el8.10.0+4068+0e21408f |
Products include Linuxfoundation Runc.
How do I fix CVE-2025-52881?
Upgrade github.com/opencontainers/runc to a fixed version for your release line: 1.2.8, 1.3.3 or 1.4.0-rc.3.
Is CVE-2025-52881 being exploited?
There is no known exploitation of CVE-2025-52881 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in opencontainers runc
- CVE-2025-52565 container escape due to /dev/console mount and related races
- CVE-2025-31133 runc container escape via "masked path" abuse due to mount race conditions
- CVE-2023-28642 AppArmor bypass with symlinked /proc in runc
- CVE-2023-25809 rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
- CVE-2024-45310 runc can be confused to create empty files/directories on the host
Sources
Also known as ALSA-2025:21220, ALSA-2025:21702, ALSA-2025:23543, AZL-69824, AZL-69826, AZL-70586 and 68 more.