CVE-2026-47766: falha de média gravidade em containers crun
crun follows rootfs /dev symlink while creating default devices
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configuration does not mount `/dev`, crun follows that symlink and creates the default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay, this created fixed device nodes and symlinks outside the rootfs before crun returned failure. A pre-existing file named `ptmx` in the target directory was also replaced by crun's forced `ptmx -> pts/ptmx` symlink. Version 1.28 fixes the issue.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
containers · crunCVEs relacionadas — containers crun
No mesmo produto, das mais perigosas para as menos.
CVE-2025-24965HIGH.krun_config.json symlink attack creates or overwrites file on the host in crunEPSS 0.6%CVE-2026-30892NONECrun incorrectly parses `crun exec` option `-u`, leading to privilege escalationEPSS 0.2%CVE-2026-88264MEDIUMCrun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfsEPSS 0.1%