CVE-2025-62596: Youki Container Runtime Escalation Flaw

CVE-2025-62596 Overview

CVE-2025-62596 affects Youki, a container runtime written in Rust. Versions 0.5.6 and below perform insufficiently strict write-target validation in their AppArmor handling logic. When combined with path substitution during pathname resolution, attackers can redirect writes to unintended procfs locations. A shared-mount race substitutes intermediate components during component-by-component path resolution, redirecting the final write target. The flaw is tracked under [CWE-61: UNIX Symbolic Link (Symlink) Following] and is fixed in version 0.5.7.

Critical Impact
Local attackers with container access can leverage a shared-mount race condition to redirect AppArmor-related writes to arbitrary procfs locations, potentially compromising host integrity and container isolation.

Affected Products

Youki container runtime versions 0.5.6 and below
Container deployments using Youki with AppArmor profiles
Rust-based OCI runtime installations relying on shared mount namespaces

Discovery Timeline

2025-11-06 - CVE-2025-62596 published to NVD
2025-11-10 - Last updated in NVD database

Technical Details for CVE-2025-62596

Vulnerability Analysis

The vulnerability resides in Youki's AppArmor handling code, which writes profile data to paths under /proc. Youki resolves these paths one component at a time rather than atomically. An attacker controlling a shared mount can swap intermediate path components mid-resolution. This time-of-check to time-of-use (TOCTOU) condition allows the final write target to be substituted for an attacker-chosen procfs location.

Writes to sensitive procfs entries can alter kernel state, modify process attributes, or undermine container confinement. The flaw chains symlink-style path substitution [CWE-61] with insufficient validation of the resolved write target. Exploitation requires local access and user interaction, but yields high impact across confidentiality, integrity, and availability.

Root Cause

The root cause is non-atomic pathname resolution combined with weak target validation. Youki traverses path components individually without holding a stable file descriptor reference. A concurrent mount operation on a shared mount namespace can replace a directory component between the validation step and the actual write. The AppArmor write logic accepts the resolved path without re-validating that it points to the originally intended procfs attribute file.

Attack Vector

An attacker requires local access and the ability to manipulate shared mount points visible to the container runtime. The attacker prepares a mount-namespace race where a benign component is swapped for one that redirects resolution to a sensitive procfs file. When Youki performs AppArmor configuration writes during container setup, the substituted path receives the write instead. See the GitHub Security Advisory for the complete technical description.

// No verified proof-of-concept code is publicly available.
// Refer to the vendor advisory for technical specifics on the
// shared-mount race and component-by-component resolution flaw.

Detection Methods for CVE-2025-62596

Indicators of Compromise

Unexpected writes to /proc/*/attr/* files from container runtime processes outside normal AppArmor profile application
Container runtime processes performing mount operations on shared mount points during container startup
AppArmor profile load failures or anomalous profile transitions correlated with Youki invocations

Detection Strategies

Audit youki binary version across container hosts and flag any instance at or below 0.5.6
Monitor system calls from the container runtime using auditd or eBPF probes for openat, write, and mount operations targeting procfs paths
Correlate container creation events with unexpected procfs write activity to detect exploitation attempts

Monitoring Recommendations

Enable kernel audit rules for writes to /proc/*/attr/current, /proc/*/attr/exec, and related AppArmor interface files
Log all mount namespace and shared mount propagation changes initiated by container runtimes
Track Youki process file descriptor activity during container initialization for unexpected path resolution patterns

How to Mitigate CVE-2025-62596

Immediate Actions Required

Upgrade Youki to version 0.5.7 or later on all hosts where the runtime is deployed
Inventory container orchestration platforms and CI/CD pipelines that bundle Youki binaries
Restrict local access to container hosts and limit which users can interact with the runtime

Patch Information

The maintainers fixed the vulnerability in Youki version 0.5.7. The corrective change is available in commit 5886c91073b9be748bd8d5aed49c4a820548030a. Operators should rebuild container images and redeploy hosts that ship the runtime to ensure the patched binary is in use. Reference the GitHub Security Advisory GHSA-vf95-55w6-qmrf for full remediation guidance.

Workarounds

Avoid running Youki with AppArmor profiles configured on affected versions until the upgrade is applied
Restrict shared mount propagation in container mount namespaces to reduce the race condition window
Apply strict mandatory access control policies on the host to limit which procfs files the runtime can modify

bash

# Verify the installed Youki version and upgrade
youki --version

# Upgrade via cargo (example)
cargo install youki --version 0.5.7 --force

# Confirm the patched version is active
youki --version