A flaw in the crun container runtime permits an attacker to redirect the special device /dev/console onto an attacker‑controlled path, allowing the creation of root‑owned files outside the container’s root filesystem. The vulnerability is triggered when the container configuration does not provide a dedicated /dev mount, relying instead on the default read‑only‑rootfs bind‑mount fallback. This bypass facilitates arbitrary file creation with elevated privileges, potentially compromising system integrity.

The issue affects Red Hat Hardened Images (Hummingbird 1) running crun versions 1.29.1 and earlier. No fix has been released; containers using default configurations that mount a fresh /dev are not exposed.

The CVSS score of 5.6 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting current exploitation likelihood is low but not negligible. The exploit requires the attacker to control the container environment—either by running an untrusted image without a dedicated /dev mount or by manipulating the /dev/console setup—making the attack vector interior to the container but resulting in root‑level file creation outside the container. Proper isolation of /dev mitigates the risk.