Critical Security Flaw in Aardvark-DNS and Related Container Tools: Container Escape Vulnerability
Summary
ALSA-2025:23543: Important: container-tools:rhel8 security update. Affects aardvark-dns across 4 version ranges.
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7
< 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe
< 2:1.10.1-2.module_el8.10.0+4047+545787c4
< 2:1.10.1-2.module_el8.10.0+4023+db236c53
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Aardvark-DNS package is a DNS server designed for use in containerized environments, providing DNS resolution for services running in containers. It is part of the container-tools module, which includes essential tools like Podman, Buildah, Skopeo, and Runc. These tools are widely used for managing container lifecycles, building images, and transferring container images between registries. The vulnerability in question affects the security of these tools, potentially allowing unauthorized access and manipulation of container environments.
Vulnerability Detail
The vulnerability, identified as CVE-2025-52881, arises from flaws in the Runc component of the container-tools module. It allows for container escape and denial of service due to arbitrary write gadgets and procfs write redirects. This means that an attacker could exploit this vulnerability to escape the confines of a container, gaining access to the host system or other containers, leading to potential data breaches or service disruptions. The implications of this vulnerability are severe, as it undermines the isolation that containers are supposed to provide.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update aardvark-dns-
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb72:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 -
< 2:1.10.1-2.module_el8.10.0+4023+db236c532:1.10.1-2.module_el8.10.0+4023+db236c53 -
< 2:1.10.1-2.module_el8.10.0+4047+545787c42:1.10.1-2.module_el8.10.0+4047+545787c4 -
< 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe2:1.10.1-2.module_el8.10.0+4089+ce72bbbe
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can limit the permissions of containers or avoid running untrusted containers until the patch is applied. Additionally, consider using security features such as SELinux or AppArmor to enhance container security.
Conclusion
The vulnerability CVE-2025-52881 poses a significant threat to the security of containerized applications using Aardvark-DNS and related tools. Users are urged to update their packages to the latest patched versions to safeguard their systems. Employing additional security measures can also help mitigate risks until updates are applied.
See every vulnerability recorded for aardvark-dns →
FAQ
CVE-2025-52881 is a security vulnerability affecting the Runc component of container-tools, allowing for container escape and denial of service.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The risks include unauthorized access to the host system, potential data breaches, and service disruptions due to denial of service.
It is recommended to regularly check for updates and apply them promptly to mitigate vulnerabilities.
If immediate updates are not possible, consider implementing security measures like SELinux or AppArmor to limit the impact of the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for aardvark-dns.
