REDHAT-BUG-2531223: Medium severity Crun crun vulnerability
A flaw was found in crun. During terminal setup, when the OCI configuration does not mount /dev, crun unlinks and recreates /dev/console without preventing symlink follows. A malicious image can make /dev/console a symlink so that crun creates a root-owned file outside the container rootfs. Affected versions are crun 1.29.1 and earlier. This is not CVE-2026-47766, which addressed following a rootfs /dev directory symlink and was fixed in crun 1.28. No fixed release is published yet.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this flaw?
An attacker needs control of a malicious OCI image and terminal setup must occur with an OCI configuration that does not mount /dev. The image can then make /dev/console a symlink, causing crun to create a root-owned file outside the container root filesystem.
Are installations fixed by updating to crun 1.28?
No. The issue affects crun 1.29.1 and earlier, and is distinct from CVE-2026-47766, which was fixed in crun 1.28. No fixed release for this flaw has been published.
What can be done while no fixed release is available?
Avoid running untrusted OCI images with terminal setup under configurations that do not mount /dev. Review OCI configurations for this condition and treat images able to control /dev/console as potentially exploitable.