# runc container escape with malicious config due to /dev/console mount and related races

runc bind-mounts /dev/pts/$n to /dev/console before applying maskedPaths/readonlyPaths, letting a malicious container config gain writable /proc/sysrq-trigger or core_pattern for host DoS or breakout.

- Payout: Research
- Severity: high
- Program: runc
- Found by: ssst0n3, lifubang, cyphar
- Disclosed: 2025-11-05
- CVE: CVE-2025-52565
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-qw9x-cqr3-wc7r
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-qw9x-cqr3-wc7r
- Tags: area:cloud domain:infra impact:dos impact:privesc kind:research platform:ghsa sev:high tech:linux technique:race-window technique:source-review vuln:misconfiguration vuln:path-traversal vuln:privilege-escalation vuln:race-condition

**Target:** /dev/console bind-mount of /dev/pts/$n in runc container setup
**Root cause:** The /dev/console bind-mount of /dev/pts/$n is performed before maskedPaths and readonlyPaths are applied, and the source path is not verified against symlink/inode swaps, so an attacker-controlled path gets mounted writable onto a normally masked/read-only target.
**Steps:**
1. Craft a malicious container config that allocates a console (so runc bind-mounts /dev/pts/$n to /dev/console).
2. Swap /dev/pts/$n (or the source path) with a symlink to a sensitive procfs file such as /proc/sysrq-trigger or /proc/sys/kernel/core_pattern.
3. runc bind-mounts the attacker path to /dev/console after pivot_root(2) but before maskedPaths/readonlyPaths are applied.
4. Container process writes through /dev/console to the procfs file, triggering host DoS (sysrq) or core_pattern-based breakout.
**How found:** Same concept as CVE-2025-31133 but applied to a different target: the /dev/pts/$n to /dev/console bind-mount. Noticed the mount ordering relative to maskedPaths/readonlyPaths, plus an audit of os.Create usages (missing O_NOFOLLOW/O_EXCL) and TIOCGPTN/TIOCGPTPEER console allocation races.
**Exploitation:** Attacker controls the container config/image and races or symlinks the console source path so runc bind-mounts a writable copy of /proc/sysrq-trigger (host DoS) or /proc/sys/kernel/core_pattern (container breakout via core dump handler) onto /dev/console inside the container, then writes to it.
**Escalation:** Chains with CVE-2025-52881 to bypass LSM labels, defeating SELinux/AppArmor mitigations; core_pattern write yields host code execution.
**Insight:** When auditing container runtimes, check the ordering of every mount against maskedPaths/readonlyPaths application, and treat any path resolved via TIOCGPTN or opened with os.Create as attacker-swappable unless O_NOFOLLOW/O_EXCL or TIOCGPTPEER is used.