ALT-PU-2026-16448-2

Package update crun in branch sisyphus

Version1.30.1-alt1

Published2026-09-25

Max severityHIGH

Severity:

Closed issues (3)

HIGH7.8

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Published: 2026-09-10Modified: 2026-09-15

CVSS 3.xHIGH 7.8

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

MEDIUM5.6

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Published: 2026-09-10Modified: 2026-09-25

CVSS 3.xMEDIUM 5.6

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

References

MEDIUM5.6

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Published: 2026-09-10Modified: 2026-10-02

CVSS 3.xMEDIUM 5.6

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

References