This vulnerability in crun occurs when the container configuration does not provide a dedicated mount for /dev. In such cases, terminal setup can redirect /dev/console onto an attacker-controlled path, including through the read-only-rootfs bind-mount fallback. This improper link resolution (CWE-59) can allow an attacker with local access and low privileges to modify files outside the intended root filesystem, potentially leading to integrity violations. Supported Red Hat container tooling mounts /dev by default, preventing exposure in supported configurations. The flaw affects crun versions 1.29.1 and earlier. No official fix has been released yet.

An attacker with local access and low privileges can exploit this vulnerability if the container configuration does not mount /dev, enabling them to redirect /dev/console to an attacker-controlled path. This can result in modification of files outside the container root filesystem, causing integrity impact. There is no confidentiality or availability impact. Default and supported Red Hat configurations that mount /dev are not affected.

Red Hat advises always mounting /dev in container configurations, which is the default behavior for Podman and crun. Avoid running untrusted container images with configurations that do not mount /dev. No fixed release is available yet, so adherence to these configuration best practices is the primary mitigation.