CVE-2025-52881

Publication date 5 November 2025

Last updated 10 July 2026

Ubuntu priority

High

Why this priority?

Cvss 3 Severity Score

7.5 · High

Score breakdown

Description

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

Read the notes from the security team

Why is this CVE high priority?

runc developers have rated this as being high severity

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
runc 25.10 questing Ignored end of life, was ignored [backport too intrusive]
25.04 plucky Ignored end of life, was ignored [backport too intrusive]
24.04 LTS noble Ignored backport too intrusive
22.04 LTS jammy Ignored backport too intrusive
20.04 LTS focal Ignored backport too intrusive
18.04 LTS bionic Ignored backport too intrusive
16.04 LTS xenial Ignored end of ESM support, was ignored [backport too intrusive]
runc-app 25.10 questing
Fixed 1.3.3-0ubuntu1~25.10.2
25.04 plucky
Fixed 1.3.3-0ubuntu1~25.04.2
24.04 LTS noble
Fixed 1.3.3-0ubuntu1~24.04.2
22.04 LTS jammy
Fixed 1.3.3-0ubuntu1~22.04.2
20.04 LTS focal Ignored backport too intrusive
runc-stable 25.10 questing
Fixed 1.3.3-0ubuntu1~25.10.2
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
20.04 LTS focal Not in release
18.04 LTS bionic Not in release
16.04 LTS xenial Not in release
14.04 LTS trusty Not in release

Notes

sbeattie

src:runc-app provides the runc binaries, src:runc provides golang-github-opencontainers-runc-dev in older releases. See LP: #2022390 and LP: #2040460 for details.

mdeslaur

Setting runc priority to low since it does not contain the actual application, only the library

Severity score breakdown

CVSS version:

Base score 7.3 · High

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Base score 7.5 · High

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities