Vulnerability-Lookup

CVE-2025-27612 (GCVE-0-2025-27612)

Vulnerability from cvelistv5 – Published: 2025-03-21 14:24 – Updated: 2025-03-21 15:20

Title

Libcontainer is affected by capabilities elevation

Summary

libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for tenant container can lead to elevation of capabilities, similar to CVE-2022-29162. This does not affect youki binary itself. This is only applicable if you are using libcontainer directly and using the tenant builder.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-276 - Incorrect Default Permissions

Assigner

GitHub_M

References

URL

Tags

	https://github.com/youki-dev/youki/security/advis…	x_refsource_CONFIRM
	https://github.com/opencontainers/runc/security/a…	x_refsource_MISC
	https://github.com/youki-dev/youki/commit/747e342…	x_refsource_MISC
	https://github.com/youki-dev/youki/blob/9e63fa4da…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	youki-dev	youki	Affected: < 0.5.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27612",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-21T15:19:54.521787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-21T15:20:00.538Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "youki",
          "vendor": "youki-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for tenant container can lead to elevation of capabilities, similar to CVE-2022-29162. This does not affect youki binary itself. This is only applicable if you are using libcontainer directly and using the tenant builder."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276: Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-21T14:24:28.756Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/youki-dev/youki/security/advisories/GHSA-5w4j-f78p-4wh9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/youki-dev/youki/security/advisories/GHSA-5w4j-f78p-4wh9"
        },
        {
          "name": "https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66"
        },
        {
          "name": "https://github.com/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1"
        },
        {
          "name": "https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408"
        }
      ],
      "source": {
        "advisory": "GHSA-5w4j-f78p-4wh9",
        "discovery": "UNKNOWN"
      },
      "title": "Libcontainer is affected by capabilities elevation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-27612",
    "datePublished": "2025-03-21T14:24:28.756Z",
    "dateReserved": "2025-03-03T15:10:34.079Z",
    "dateUpdated": "2025-03-21T15:20:00.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-27612\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-21T15:19:54.521787Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-21T15:19:57.250Z\"}}], \"cna\": {\"title\": \"Libcontainer is affected by capabilities elevation\", \"source\": {\"advisory\": \"GHSA-5w4j-f78p-4wh9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"youki-dev\", \"product\": \"youki\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.5.3\"}]}], \"references\": [{\"url\": \"https://github.com/youki-dev/youki/security/advisories/GHSA-5w4j-f78p-4wh9\", \"name\": \"https://github.com/youki-dev/youki/security/advisories/GHSA-5w4j-f78p-4wh9\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66\", \"name\": \"https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1\", \"name\": \"https://github.com/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408\", \"name\": \"https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for tenant container can lead to elevation of capabilities, similar to CVE-2022-29162. This does not affect youki binary itself. This is only applicable if you are using libcontainer directly and using the tenant builder.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-276\", \"description\": \"CWE-276: Incorrect Default Permissions\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-03-21T14:24:28.756Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-27612\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-21T15:20:00.538Z\", \"dateReserved\": \"2025-03-03T15:10:34.079Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-03-21T14:24:28.756Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-5W4J-F78P-4WH9

Vulnerability from github – Published: 2025-03-21 15:18 – Updated: 2025-03-21 15:42

Summary

Libcontainer is affected by capabilities elevation similar to GHSA-f3fp-gc8g-vw66

Details

Impact

In libcontainer, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. Code can be seen here . The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container.

However, GHSA-f3fp-gc8g-vw66 was opened on runc mentioning that setting inherited caps in any case for tenant container can lead to elevation of capabilities. For this, they added a fix here where they never set new inherited caps on tenant, and set ambient caps only if original container had inherited caps.

Similarly crun never sets inherited caps as can be seen here.

[!NOTE] This does not affect youki binary itself, as the exec implementation is partially broken and does not pass on the user-provided caps to tenant containers, this is only applicable if you are using libcontainer directly and using the tenant builder.

Workarounds

Do not pass any user-provided capabilities to the tenant builder, in which case no capabilities will be set on tenant.
Alternatively you can verify the capabilities of original container and filter the user passed capabilities before setting them on tenant.

References

https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66
https://man7.org/linux/man-pages/man7/capabilities.7.html

Severity ?

5.9 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "libcontainer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-27612"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T15:18:28Z",
    "nvd_published_at": "2025-03-21T15:15:42Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIn libcontainer, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. Code can be seen [here](https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408) . The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container.\n\nHowever, GHSA-f3fp-gc8g-vw66 was opened on runc mentioning that setting inherited caps in any case for tenant container can lead to elevation of capabilities. For this, they added a fix [here](https://github.com/opencontainers/runc/blob/986451c24e17c8d4be3c454f60b1f7be4af3e8b4/exec.go#L234-L242) where they never set new inherited caps on tenant, and set ambient caps only if original container had inherited caps.\n\nSimilarly crun never sets inherited caps as can be seen [here](https://github.com/containers/crun/blob/3ec6298abd79e144fbf3fa6db90793ff4c0516f9/src/exec.c#L319).\n\n\u003e [!NOTE]\nThis does not affect youki binary itself, as the exec implementation is partially broken and does not pass on the user-provided caps to tenant containers, this is only applicable if you are using libcontainer directly and using the tenant builder.\n\n### Workarounds\n- Do not pass any user-provided capabilities to the tenant builder, in which case no capabilities will be set on tenant.\n- Alternatively you can verify the capabilities of original container and filter the user passed capabilities before setting them on tenant.\n\n### References\n- https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66\n- https://man7.org/linux/man-pages/man7/capabilities.7.html",
  "id": "GHSA-5w4j-f78p-4wh9",
  "modified": "2025-03-21T15:42:03Z",
  "published": "2025-03-21T15:18:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66"
    },
    {
      "type": "WEB",
      "url": "https://github.com/youki-dev/youki/security/advisories/GHSA-5w4j-f78p-4wh9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27612"
    },
    {
      "type": "WEB",
      "url": "https://github.com/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/containers/crun/blob/3ec6298abd79e144fbf3fa6db90793ff4c0516f9/src/exec.c#L319"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/runc/blob/986451c24e17c8d4be3c454f60b1f7be4af3e8b4/exec.go#L234-L242"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/youki-dev/youki"
    },
    {
      "type": "WEB",
      "url": "https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408"
    },
    {
      "type": "WEB",
      "url": "https://man7.org/linux/man-pages/man7/capabilities.7.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Libcontainer is affected by capabilities elevation similar to GHSA-f3fp-gc8g-vw66"
}

FKIE_CVE-2025-27612

Vulnerability from fkie_nvd - Published: 2025-03-21 15:15 - Updated: 2025-03-21 15:15

Severity ?

5.9 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66
	security-advisories@github.com	https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408
	security-advisories@github.com	https://github.com/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1
	security-advisories@github.com	https://github.com/youki-dev/youki/security/advisories/GHSA-5w4j-f78p-4wh9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for tenant container can lead to elevation of capabilities, similar to CVE-2022-29162. This does not affect youki binary itself. This is only applicable if you are using libcontainer directly and using the tenant builder."
    },
    {
      "lang": "es",
      "value": "libcontainer es una librer\u00eda para el control de contenedores. Antes de libcontainer 0.5.3, al crear un contenedor de inquilinos, el generador de inquilinos aceptaba una lista de capacidades que se a\u00f1ad\u00edan a la especificaci\u00f3n del contenedor. La l\u00f3gica aqu\u00ed a\u00f1ade las capacidades dadas a todas las capacidades del contenedor principal si est\u00e1n presentes en la especificaci\u00f3n; de lo contrario, simplemente se establecen las capacidades proporcionadas como capacidades del contenedor de inquilinos. Sin embargo, establecer l\u00edmites heredados para el contenedor de inquilinos puede provocar la elevaci\u00f3n de capacidades, similar a CVE-2022-29162. Esto no afecta al binario de Youki. Esto solo aplica si se usa libcontainer directamente y el generador de inquilinos."
    }
  ],
  "id": "CVE-2025-27612",
  "lastModified": "2025-03-21T15:15:42.153",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-21T15:15:42.153",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/youki-dev/youki/security/advisories/GHSA-5w4j-f78p-4wh9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-27612 (GCVE-0-2025-27612)

GHSA-5W4J-F78P-4WH9

Impact

Workarounds

References

FKIE_CVE-2025-27612

Tags

Sightings

Nomenclature