Home / Security / Advisories / NTAP-20251121-0002

NTAP-20251121-0002 — CVE-2025-52565 Runc Vulnerability in NetApp Products

Published 2025-11-21 · Updated 2026-09-22 · Status: Interim · Exploitation: Public · Severity: HIGH 7.5 · ONTAP affected: Yes

Official advisory: NTAP-20251121-0002 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Astra Control · ONTAP · NetApp Console / BlueXP · SolidFire / NetApp HCI | ONTAP-relevant | highest CVSS: 7.5

CVEs in this advisory

CVE-2025-52565 — HIGH · CVSS 7.5 · site index

What the CVE records say

CVE-2025-52565 — runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

Impact

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS).

Affected products

Astra Control Center
ONTAP tools for VMware vSphere 10
NetApp Console Agent
NetApp Console Agent OVA
NetApp SolidFire & HCI Management Node
NetApp SolidFire & HCI Storage Node (Element Software)

Official fixes

ONTAP tools for VMware vSphere 10 — vendor fix ↗

References

https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.