A flaw in the crun container runtime allows an attacker that can trigger a pivot_root and reopen /dev/null to make the runtime follow a symlink, bind‑mount a host file into the container’s standard I/O, and then change that file’s ownership. The flaw enables altering files on the host system, which can compromise the integrity of important system files and potentially elevate privileges if the changed file is used by privileged processes. The weakness is a form of path traversal (CWE‑59).

Affected vendors and products include Red Hat Hardened Images, which uses the Red Hat Hummingbird project. Affected versions are crun 1.29.1 and earlier.

The CVSS score of 5.6 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation. The likely attack vector requires the attacker to be able to run a privileged container that performs pivot_root and reopens /dev/null for stdio, so the exploitation risk in a standard containerized environment is limited but it remains a serious local attack that can affect the host filesystem. The absence of a published fix means the risk persists until a new crun release is available.