CVE-2025-54867
published 2025-08-14CVE-2025-54867: Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to…
PriorityP433high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.16%
5.6th percentile
Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| youki-dev | youki | < 0.5.5 | 0.5.5 |
| youki-dev | youki | >= 0 < 0.5.5 | 0.5.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
osv·2025-08-14
CVE-2025-54867 [HIGH] Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
### Summary
If `/proc` and `/sys` in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
### Details
For security reasons, container creation should be prohibited if `/proc` or `/sys` in the rootfs is a symbolic link.
I verified this behavior with `youki`.
When `/proc` or `/sys` is a symbolic link, `runc` fails to create the container, whereas `youki` successfully creates it.
This is the fix related to this issue in `runc`.
* https://github.com/opencontainers/runc/pull/3756
* https://github.com/opencontainers/runc/pull/3773
* https://github.com/opencontainers/runc/blob/main/libcontainer/rootfs_l
GHSA
Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
ghsa·2025-08-14
CVE-2025-54867 [HIGH] CWE-61 Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
### Summary
If `/proc` and `/sys` in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
### Details
For security reasons, container creation should be prohibited if `/proc` or `/sys` in the rootfs is a symbolic link.
I verified this behavior with `youki`.
When `/proc` or `/sys` is a symbolic link, `runc` fails to create the container, whereas `youki` successfully creates it.
This is the fix related to this issue in `runc`.
* https://github.com/opencontainers/runc/pull/3756
* https://github.com/opencontainers/runc/pull/3773
* https://github.com/opencontainers/runc/blob/main/libcontainer/rootfs_l
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-14
Published