Skip to content
OpenAdvisories
High RLSA-2025:23543 1 CVE

Important: container-tools:rhel8 security update

Published Dec 18, 2025 · Updated Dec 18, 2025

Ecosystem: Rocky Linux

Summary

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 124

ReleasePackageFixed in
Rocky Linux · 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 cockpit-podman 0:84.1-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 cockpit-podman 0:84.1-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 cockpit-podman 0:84.1-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 cockpit-podman 0:84.1-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 cockpit-podman 0:84.1-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8 cockpit-podman 0:84.1-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 cockpit-podman 0:84.1-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 cockpit-podman 0:84.1-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8 cockpit-podman 0:84.1-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 conmon 3:2.1.10-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8 conmon 3:2.1.10-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 conmon 3:2.1.10-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 conmon 3:2.1.10-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 conmon 3:2.1.10-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 conmon 3:2.1.10-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 conmon 3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 conmon 3:2.1.10-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 container-selinux 2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 container-selinux 2:2.229.0-2.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 container-selinux 2:2.229.0-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 container-selinux 2:2.229.0-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 container-selinux 2:2.229.0-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 container-selinux 2:2.229.0-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 container-selinux 2:2.229.0-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 container-selinux 2:2.229.0-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8 container-selinux 2:2.229.0-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8 containernetworking-plugins 1:1.4.0-6.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 containers-common 2:1-82.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 containers-common 2:1-82.module+el8.10.0+1874+ce489889
Rocky Linux · 8 containers-common 2:1-82.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 containers-common 2:1-82.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 containers-common 2:1-82.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 containers-common 2:1-82.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 containers-common 2:1-82.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 criu 0:3.18-5.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 criu 0:3.18-5.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 criu 0:3.18-5.module+el8.10.0+1874+ce489889
Rocky Linux · 8 criu 0:3.18-5.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 criu 0:3.18-5.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 criu 0:3.18-5.module+el8.10.0+1825+623b0c20
Rocky Linux · 8 criu 0:3.18-5.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 criu 0:3.18-5.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 criu 0:3.18-5.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 crun 0:1.14.3-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 crun 0:1.14.3-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8 crun 0:1.14.3-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 crun 0:1.14.3-2.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 crun 0:1.14.3-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 crun 0:1.14.3-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8 crun 0:1.14.3-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 crun 0:1.14.3-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 crun 0:1.14.3-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 fuse-overlayfs 0:1.13-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 fuse-overlayfs 0:1.13-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 fuse-overlayfs 0:1.13-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8 fuse-overlayfs 0:1.13-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 fuse-overlayfs 0:1.13-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 fuse-overlayfs 0:1.13-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 fuse-overlayfs 0:1.13-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 fuse-overlayfs 0:1.13-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 fuse-overlayfs 0:1.13-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8 libslirp 0:4.4.0-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 libslirp 0:4.4.0-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8 libslirp 0:4.4.0-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 libslirp 0:4.4.0-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 libslirp 0:4.4.0-2.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 libslirp 0:4.4.0-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 libslirp 0:4.4.0-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 libslirp 0:4.4.0-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 libslirp 0:4.4.0-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8 netavark 2:1.10.3-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 netavark 2:1.10.3-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8 netavark 2:1.10.3-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 netavark 2:1.10.3-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 netavark 2:1.10.3-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 netavark 2:1.10.3-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 netavark 2:1.10.3-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 netavark 2:1.10.3-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 netavark 2:1.10.3-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8 python-podman 0:4.9.0-3.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 python-podman 0:4.9.0-3.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 python-podman 0:4.9.0-3.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 slirp4netns 0:1.2.3-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8 slirp4netns 0:1.2.3-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8 slirp4netns 0:1.2.3-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 slirp4netns 0:1.2.3-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8 slirp4netns 0:1.2.3-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 slirp4netns 0:1.2.3-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 slirp4netns 0:1.2.3-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 slirp4netns 0:1.2.3-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 slirp4netns 0:1.2.3-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 toolbox 0:0.0.99.5-2.module+el8.10.0+1880+8e896d1b.rocky.0.2
Rocky Linux · 8 toolbox 0:0.0.99.5-2.module+el8.10.0+2001+6a33db9f.rocky.0.2
Rocky Linux · 8 toolbox 0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2
Rocky Linux · 8 toolbox 0:0.0.99.5-2.module+el8.10.0+1829+9bb2696f.rocky.0.2
Rocky Linux · 8 toolbox 0:0.0.99.5-2.module+el8.10.0+1825+623b0c20.rocky.0.2
Rocky Linux · 8 toolbox 0:0.0.99.5-2.module+el8.10.0+1872+2e18eb19.rocky.0.2
Rocky Linux · 8 toolbox 0:0.0.99.5-2.module+el8.10.0+1843+6892ab28.rocky.0.2
Rocky Linux · 8 toolbox 0:0.0.99.5-2.module+el8.10.0+1874+ce489889.rocky.0.2
Rocky Linux · 8 toolbox 0:0.0.99.5-2.module+el8.10.0+1896+b18fa106.rocky.0.2
Rocky Linux · 8 toolbox 0:0.0.99.5-2.module+el8.10.0+1948+4b5cd4a9.rocky.0.2
Rocky Linux · 8 udica 0:0.2.6-21.module+el8.10.0+1896+b18fa106
Rocky Linux · 8 udica 0:0.2.6-21.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8 udica 0:0.2.6-21.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8 udica 0:0.2.6-21.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8 udica 0:0.2.6-21.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8 udica 0:0.2.6-21.module+el8.10.0+1874+ce489889
Rocky Linux · 8 udica 0:0.2.6-21.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8 udica 0:0.2.6-21.module+el8.10.0+1825+623b0c20
Rocky Linux · 8 udica 0:0.2.6-21.module+el8.10.0+1843+6892ab28

Vulnerabilities 1

  • High 7.3
    CVE-2025-52881 Public exploit

    runc: LSM labels can be bypassed with malicious config using dummy procfs files

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with s…

    opencontainers runc zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2404715