CVE-2025-2713CWE-266

Improper File Permission Handling in Google gVisor runsc

Medium · published March 28, 2025

CVSS v4.0
6.8
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00073 · 0.1th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-03-28T15:27Z
EPSS history
Timeline
  • 28 MAR 15:27Z
    Improper File Permission Handling in Google gVisor runsc
    cvelistv5