CyberRota Analysis
AI-GeneratedA vulnerability in crun allows an attacker to exploit symlink handling after a pivot_root operation, potentially linking a host file to container stdio and altering its ownership. This could lead to unauthorized access or manipulation of host files from within a container. Organizations using crun versions 1.29.1 and earlier should prioritize addressing this issue, especially those with configurations that do not mount a fresh /dev.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.