REDHAT-BUG-2531224: Medium severity crun vulnerability
A flaw was found in crun. After pivotroot or chroot, crun reopens /dev/null for stdio without preventing symlink follows. If /dev is not mounted and a malicious image replaces /dev/null with a symlink, crun can open a host bind-mounted file and a non-root container process can write to it and chown it. Affected versions are crun 1.29.1 and earlier. This is a separate issue from CVE-2026-47766 and from the /dev/console symlink flaw. No fixed release is published yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If using crun with pivot_root or chroot, ensure /dev is mounted inside the container (so /dev/null cannot be replaced by a malicious symlink).
- Compensating control
When running containers with crun, prevent untrusted/malicious images from controlling /dev (e.g., disallow images that can replace /dev/null with a symlink), especially in scenarios where /dev is not mounted.
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this flaw?
Exposure requires a container image controlled by an attacker that can replace /dev/null with a symlink, combined with a runtime environment where /dev is not mounted after pivot_root or chroot. The symlink must resolve to a host file that is bind-mounted into the container.
What access does an attacker need to exploit it?
An attacker needs to supply or control a malicious container image and have that image run under an affected crun version. The described impact can then be exercised by a non-root process inside the container.
What could an attacker do to the targeted host file?
The non-root container process can write to the host bind-mounted file opened through the malicious /dev/null symlink and can chown that file.
Is a fix available?
No fixed crun release is published yet. Affected versions are crun 1.29.1 and earlier.