GHSA-j26p-6wx7-f3pwHighCVSS 7.0
Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
🔗 CVE IDs covered (1)
📋 Description
Summary
If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
Details
For security reasons, container creation should be prohibited if /proc or /sys in the rootfs is a symbolic link.
I verified this behavior with youki.
When /proc or /sys is a symbolic link, runc fails to create the container, whereas youki successfully creates it.
This is the fix related to this issue in runc.
- https://github.com/opencontainers/runc/pull/3756
- https://github.com/opencontainers/runc/pull/3773
- https://github.com/opencontainers/runc/blob/main/libcontainer/rootfs_linux.go#L590
- https://github.com/opencontainers/runc/blob/main/tests/integration/mask.bats#L60
Impact
The following advisory appears to be related to this vulnerability:
- https://github.com/advisories/GHSA-vpvm-3wq2-2wvm
- https://github.com/advisories/GHSA-fh74-hm69-rqjw
🎯 Affected products1
- rust/youki:< 0.5.5
🔗 References (5)
- https://github.com/youki-dev/youki/security/advisories/GHSA-j26p-6wx7-f3pw
- https://github.com/youki-dev/youki/commit/0d9b4f2aa5ceaf988f3eb568711d2acf0a4ace37
- https://github.com/youki-dev/youki/releases/tag/v0.5.5
- https://nvd.nist.gov/vuln/detail/CVE-2025-54867
- https://github.com/advisories/GHSA-j26p-6wx7-f3pw