Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2439

NIXPKGS-2026-2439
published 10 hours ago
crun follows rootfs /dev symlink while creating default devices
Permalink CVE-2026-47766
5.1 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 10 hours ago by @LeSuisse Activity log
  • Created suggestion 23 hours ago
  • @LeSuisse ignored
    8 packages
    • nym
    • crunch
    • y-cruncher
    • speedcrunch
    • ocaml-crunch
    • ocamlPackages.crunch
    • ocamlPackages_latest.crunch
    • vscode-extensions.42crunch.vscode-openapi
    10 hours ago
  • @LeSuisse accepted 10 hours ago
  • @LeSuisse published on GitHub 10 hours ago
crun follows rootfs /dev symlink while creating default devices

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configuration does not mount `/dev`, crun follows that symlink and creates the default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay, this created fixed device nodes and symlinks outside the rootfs before crun returned failure. A pre-existing file named `ptmx` in the target directory was also replaced by crun's forced `ptmx -> pts/ptmx` symlink. Version 1.28 fixes the issue.

Affected products

crun
  • ==< 1.28

Matching in nixpkgs

pkgs.crun

Fast and lightweight fully featured OCI runtime and C library for running containers

Ignored packages (8)

pkgs.crunch

Wordlist generator

  • nixos-unstable 3.6
    • nixpkgs-unstable 3.6
    • nixos-unstable-small 3.6
  • nixos-26.05 3.6
    • nixos-26.05-small 3.6
    • nixpkgs-26.05-darwin 3.6

Package maintainers