Bug 2404715 (CVE-2025-52881)
| Summary: | CVE-2025-52881 runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abarbaro, adudiak, akoudelk, alcohan, alinfoot, alizardo, anpicker, asatyam, bbrownin, bdettelb, bparees, carogers, dfreiber, dhanak, diagrawa, doconnor, drosa, drow, dsimansk, dtrifiro, dymurray, eglynn, erezende, fdeutsch, gparvin, haoli, hasun, hkataria, ibolton, jajackso, jbalunas, jburrell, jcammara, jcantril, jchui, jfula, jhe, jjoyce, jkoehler, jmatthew, jmitchel, jmontleo, jneedle, jowilson, jsamir, jschluet, kaycoth, kegrant, kingland, koliveir, kshier, ktsao, kverlaen, lbragsta, lgamliel, lhh, ljawale, lphiri, lsvaty, luizcosta, mabashia, manissin, matzew, mburns, mgarciac, mnovotny, nboldt, nweather, nyancey, ometelka, oramraz, owatkins, pahickey, pakotvan, pbraun, pgaikwad, pgrist, psrna, ptisnovs, rbobbitt, rbryant, rfreiman, rhaigner, rjohnson, rojacob, sabiswas, sakbas, sausingh, sdawley, security-response-team, shvarugh, simaishi, slucidi, smcdonal, smullick, sseago, stcannon, sthirugn, stirabos, syedriko, teagle, tfister, thason, thavo, vkumar, weaton, wenshen, whayutin, xdharmai, xiyuan, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2412965, 2423984, 2423985, 2423988, 2423991, 2423992, 2423996, 2423997, 2423998, 2423999, 2424000, 2424001, 2424002, 2424003, 2424004, 2424005, 2424006, 2424007, 2424008, 2424009, 2424010, 2424011, 2424012, 2424013, 2424014, 2424015, 2424016, 2424017, 2424018, 2424019, 2424020, 2424021, 2424022, 2424023, 2424027, 2424030, 2424031, 2424032, 2424033, 2424034, 2424035, 2424036, 2424037, 2424038, 2424039, 2424040, 2424041, 2424043, 2424044, 2424045, 2424046, 2424048, 2424051, 2424053, 2424055, 2424057, 2424059, 2424060, 2424063, 2424066, 2424068, 2424069, 2424072, 2424075, 2412964, 2423983, 2423986, 2423987, 2423989, 2423990, 2423993, 2423994, 2423995, 2424024, 2424025, 2424026, 2424028, 2424029, 2424071, 2424073, 2424074 | ||
| Bug Blocks: | |||
| Deadline: | 2025-11-05 | ||
|
Description
OSIDB Bzimport
2025-10-17 15:10:11 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:19927 https://access.redhat.com/errata/RHSA-2025:19927 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:20957 https://access.redhat.com/errata/RHSA-2025:20957 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:21220 https://access.redhat.com/errata/RHSA-2025:21220 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:21232 https://access.redhat.com/errata/RHSA-2025:21232 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2025:21633 https://access.redhat.com/errata/RHSA-2025:21633 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2025:21634 https://access.redhat.com/errata/RHSA-2025:21634 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:21702 https://access.redhat.com/errata/RHSA-2025:21702 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2025:21328 https://access.redhat.com/errata/RHSA-2025:21328 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:22012 https://access.redhat.com/errata/RHSA-2025:22012 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:22011 https://access.redhat.com/errata/RHSA-2025:22011 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2025:22030 https://access.redhat.com/errata/RHSA-2025:22030 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:21795 https://access.redhat.com/errata/RHSA-2025:21795 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2025:21824 https://access.redhat.com/errata/RHSA-2025:21824 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2025:22275 https://access.redhat.com/errata/RHSA-2025:22275 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:23543 https://access.redhat.com/errata/RHSA-2025:23543 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2025:23347 https://access.redhat.com/errata/RHSA-2025:23347 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2025:23113 https://access.redhat.com/errata/RHSA-2025:23113 |