CVE-2025-52881 is a local privilege escalation vulnerability in runc, the container runtime used by Red Hat OpenShift Builds. It allows an attacker with minimal privileges to redirect writes of LSM process labels to dummy tmpfs files, bypassing the correct application of security labels and potentially enabling container escape. This vulnerability is a more advanced variant of CVE-2019-16884. The flaw arises because runc does not adequately verify the target of LSM label writes, allowing improper link resolution and arbitrary file writes within procfs. Red Hat has classified this as an important flaw with high impact on confidentiality, integrity, and availability, but limited to local attacks. The vendor has released an updated OpenShift Compliance Operator (v1.9.0) that includes fixes and enhancements related to this and other issues. Mitigations include running containers rootless to reduce privileges, but SELinux and AppArmor cannot fully prevent exploitation due to the privileged nature of the container runtime.

The vulnerability allows a local attacker with minimal privileges to bypass Linux Security Module protections by redirecting writes of security labels to unintended files, potentially leading to container breakout and unauthorized code execution. The impact includes high confidentiality, integrity, and availability risks within the affected container environment. However, exploitation requires local access and user interaction. There are no known exploits in the wild at this time.

Red Hat has released an updated OpenShift Compliance Operator image version 1.9.0 that addresses this vulnerability. Users should apply this update following Red Hat's official update procedures. Additional mitigations include running containers in rootless mode to reduce the privileges of runc and block most inadvertent writes. SELinux and AppArmor do not fully mitigate this vulnerability due to the privileged nature of the container runtime. Users should ensure all previously released errata are applied before updating. No urgent action is required beyond applying the official update and considering rootless container usage.