CVE-2025-2713 | Vulnetix

CVE-2025-2713 PUBLISHED CVSS 6.800000190734863 MEDIUM

Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork.

EPSS 0.07% · 0.1th percentile

Risk Scores

CVSS 4.0

6.800000190734863

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score

0.07%

0.1th percentile

Affected Products

Vendor	Product	Versions
Google	gVisor	release-20250319.0
google	gvisor	0

Timeline

Mar 28, 2025 Coalition ESS Score
Mar 28, 2025 CVE Published
Mar 29, 2025 EPSS Score
Apr 11, 2025 EPSS Score
Apr 24, 2025 EPSS Score
May 7, 2025 EPSS Score
May 20, 2025 EPSS Score
Jun 2, 2025 EPSS Score
Jun 15, 2025 EPSS Score
Jun 28, 2025 EPSS Score
Jul 11, 2025 EPSS Score
Jul 24, 2025 EPSS Score

References

Open in Interactive Console →