CVE-2025-54867
📋 TL;DR
This vulnerability in Youki container runtime allows attackers to escape container isolation and access the host filesystem when /proc and /sys in the rootfs are symbolic links. It affects Youki versions before 0.5.5. Containerized applications using vulnerable Youki versions are at risk of host compromise.
💻 Affected Systems
- Youki container runtime
📦 What is this software?
Youki by Youki Dev
⚠️ Risk & Real-World Impact
Worst Case
Full host root filesystem access leading to complete host compromise, data theft, and lateral movement to other containers or systems.
Likely Case
Container escape allowing attackers to read sensitive host files, modify system configurations, or install persistence mechanisms.
If Mitigated
Limited impact if containers run with minimal privileges, but still potential for information disclosure about host system.
🎯 Exploit Status
Requires ability to create or modify container images with specific symlink configurations; not trivial but achievable by attackers with container creation privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.5.5
Vendor Advisory: https://github.com/youki-dev/youki/security/advisories/GHSA-j26p-6wx7-f3pw
Restart Required: Yes
Instructions:
1. Stop all containers running with Youki. 2. Update Youki to version 0.5.5 using your package manager or from GitHub releases. 3. Restart containers with updated runtime.
🔧 Temporary Workarounds
Disable symlinks in container rootfs
linuxPrevent containers from having /proc or /sys as symbolic links in their root filesystem
Ensure container images do not contain symlinks at /proc or /sys paths in rootfs
Use alternative container runtime
linuxTemporarily switch to runc or containerd while patching Youki
docker info --format '{{.ServerVersion}}'
Check current runtime and switch if using Youki
🧯 If You Can't Patch
- Restrict container privileges using seccomp, AppArmor, or SELinux profiles
- Implement network segmentation to isolate containers with vulnerable runtime
🔍 How to Verify
Check if Vulnerable:
Check Youki version: youki --version | grep -q '0\.5\.[0-4]\|0\.[0-4]\|^[0-4]\.[0-9]' && echo 'VULNERABLE'Check Version:
youki --versionVerify Fix Applied:
Verify version is 0.5.5 or higher: youki --version | grep -q '0\.5\.5\|^0\.6\|^[1-9]' && echo 'PATCHED'📡 Detection & Monitoring
Log Indicators:
- Unusual access to host /proc or /sys paths from container processes
- Container runtime errors related to symlink resolution
Network Indicators:
- Unexpected outbound connections from container to host services
SIEM Query:
process.name:youki AND (event.action:symlink OR file.path:"/proc/*" OR file.path:"/sys/*")