CVE-2025-54867: Youki Container Runtime Path Traversal Flaw

CVE-2025-54867 Overview

CVE-2025-54867 affects Youki, a container runtime written in Rust that implements the OCI runtime specification. Versions prior to 0.5.5 fail to properly validate /proc and /sys when they exist as symbolic links inside the container rootfs. A local attacker who controls the container image or rootfs contents can leverage this symlink handling flaw to escape container isolation and access the host root filesystem. The issue is tracked under [CWE-61: UNIX Symbolic Link (Symlink) Following] and was patched in Youki version 0.5.5.

Critical Impact
Successful exploitation breaks container isolation, granting read and write access to the host root filesystem from within a container.

Affected Products

Youki container runtime versions prior to 0.5.5
Container platforms and orchestrators embedding vulnerable Youki builds
Linux hosts running OCI workloads via Youki as the low-level runtime

Discovery Timeline

2025-08-14 - CVE-2025-54867 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54867

Vulnerability Analysis

Youki prepares a container's root filesystem before pivoting into it. During this setup, the runtime mounts the pseudo-filesystems /proc and /sys at their expected paths inside the container rootfs. Prior to version 0.5.5, Youki did not verify whether those paths were regular directories or symbolic links planted inside the rootfs.

When /proc or /sys in the rootfs is a symlink pointing outside the container tree, the mount operation follows the symlink and performs the mount against a host-side target. This allows a crafted rootfs to redirect the runtime's privileged mount syscalls onto host paths, exposing host directories inside the container namespace.

Root Cause

The underlying defect is unsafe symlink following during rootfs preparation, a classic [CWE-61] pattern. The rootfs mount logic in crates/libcontainer/src/rootfs/mod.rs did not enforce that mount targets resolve to real directories inside the container root before invoking the mount syscall. An attacker-controlled rootfs supplying /proc or /sys as symlinks was sufficient to steer the mount elsewhere.

Attack Vector

Exploitation requires local access with permission to supply or influence a container rootfs consumed by Youki. The attacker crafts a rootfs image where /proc and/or /sys are symlinks to arbitrary host paths. When Youki starts the container, the runtime performs mounts against the symlink targets on the host, giving the container process a view into the host filesystem and enabling privilege escalation to the host root context.

rust

// Patch excerpt: crates/libcontainer/src/rootfs/mod.rs
 pub use device::Device;
 
 pub(super) mod mount;
+pub use mount::Mount;
+
 pub(super) mod symlink;
 
 pub mod utils;

Source: Youki commit 0d9b4f2. The patch reworks how the Mount and symlink modules cooperate so that rootfs mount targets are validated rather than blindly followed.

Detection Methods for CVE-2025-54867

Indicators of Compromise

Container images or rootfs bundles where /proc or /sys are symbolic links rather than directories.
Unexpected bind or procfs/sysfs mount events targeting host paths outside the container rootfs.
Container processes reading or writing files that resolve to host paths such as /etc/shadow or /root.

Detection Strategies

Inspect rootfs bundles before launch with find <rootfs> -maxdepth 1 -type l to flag symlinked top-level pseudo-filesystem paths.
Audit mount syscalls from the Youki runtime process using auditd or eBPF and correlate targets against the intended container root.
Compare running Youki binary versions against 0.5.5 across build pipelines and container hosts.

Monitoring Recommendations

Enable Linux audit rules on mount, symlinkat, and openat syscalls invoked by container runtimes.
Alert on container workloads accessing host paths under /etc, /root, /var/lib, or /proc/1/root.
Track Youki release consumption in software bills of materials (SBOMs) to identify vulnerable deployments quickly.

How to Mitigate CVE-2025-54867

Immediate Actions Required

Upgrade Youki to version 0.5.5 or later on every host running the runtime.
Rebuild and redeploy any container platform packaging Youki as a bundled dependency.
Restrict which users and services can submit container rootfs bundles to Youki.

Patch Information

The fix is delivered in Youki release v0.5.5 and described in GitHub Security Advisory GHSA-j26p-6wx7-f3pw. The corresponding source change is in commit 0d9b4f2, which validates rootfs mount targets and prevents symlink following for /proc and /sys.

Workarounds

Reject or rewrite container images whose rootfs contains symlinks at /proc or /sys before invoking Youki.
Run Youki under a mandatory access control policy (SELinux or AppArmor) that denies mounts against sensitive host paths.
Constrain container hosts with user namespaces so that a successful escape does not yield host root privileges.

bash

# Verify installed Youki version and scan rootfs bundles for risky symlinks
youki --version
find /var/lib/containers/*/rootfs -maxdepth 1 \( -name proc -o -name sys \) -type l -print