Vulnerability · Published Mar 21, 2025 · Assigned by GitHub_M

CVE-2025-27612Libcontainer is affected by capabilities elevation

Medium 5.9

In plain English

A medium-severity incorrect default permissions in youki from youki-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 92.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for tenant container can lead to elevation of capabilities, similar to CVE-2022-29162. This does not affect youki binary itself. This is only applicable if you are using libcontainer directly and using the tenant builder.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/opencontainers/runc	no fix listed	GO-2025-3543

Affected products (as reported)

Vendor	Product	Versions
youki-dev	youki	< 0.5.3

Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/youki-dev/youki/security/advisories/GHSA-5w4j-f78p-4wh9 x_refsource_CONFIRM
https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 x_refsource_MISC
https://github.com/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1 x_refsource_MISC
https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408 x_refsource_MISC