CVE-2025-27612 json
Libcontainer is affected by capabilities elevation
published 2025-03-21 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7244 , GHSA-5w4j-f78p-4wh9 , GO-2025-3543
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 7%
- public exploits
- 0
- none known
Summary
libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for tenant container can lead to elevation of capabilities, similar to CVE-2022-29162. This does not affect youki binary itself. This is only applicable if you are using libcontainer directly and using the tenant builder.
Patch / fix
- crates.io libcontainer 0.5.3
- youki-dev youki 0.5.3
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250327T184518-1.1
opensuse advisories openSUSE-SU-2025:14937-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-27612 updated cvss 5.9
libcontainer: Libcontainer is affected by capabilities elevation
-
Red Hat OpenShift Container Platform 4 kata-containersaffected: workaround, no fix available “Fix deferred”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | libcontainer | <0.5.3 |
0.5.3 |
Affected products
- youki-dev youki
Classification
- Weakness
-
- CWE-276 Incorrect Default Permissions
References
-
github.com
/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1
web
-
github.com
/youki-dev/youki/security/advisories/GHSA-5w4j-f78p-4wh9
web
-
github.com
/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66
web
-
github.com
/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builde
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-27612
advisory
-
github.com
/containers/crun/blob/3ec6298abd79e144fbf3fa6db90793ff4c0516f9/src/exec.c#L319
web
-
github.com
/opencontainers/runc/blob/986451c24e17c8d4be3c454f60b1f7be4af3e8b4/exec.go#L234-L242
web
-
github.com
/youki-dev/youki
package
-
man7.org
/linux/man-pages/man7/capabilities.7.html
web
Sources
- CVE List CVE-2025-27612
- GitHub Advisory GHSA-5w4j-f78p-4wh9
- NVD CVE-2025-27612
- OSV GO-2025-3543
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.