CVE-2025-62161: About Youki, a container runtime written in Rust (10th Nov 2025)

Preface: Amazon, Google, Microsoft, Apple, Cloudflare, Coursera, Discord, Dropbox, and Figma are among the large companies employing Rust for various purposes, including cloud infrastructure, operating system components, web services, and low-level security components.

Youki is gaining increasing attention as a container runtime, especially in the Rust ecosystem, but it has not yet achieved the widespread adoption of mature runtimes such as runc or crun.

runc is a common and fundamental component in Docker environments. runc is the default low-level container runtime used by Docker Engine. Kubernetes, through its Container Runtime Interface (CRI), interacts with a CRI-compliant runtime like containerd or CRI-O. So, while Kubernetes doesn’t directly interact with runc, it relies on higher-level runtimes that use runc for the low-level container operations.

Background: A new container runtime in Rust. youki has the potential to be faster and use less memory than runc. While runc’s memory usage during container initialization can be around 2.2-3MB, Youki aims to reduce this footprint.

Rust may not be the primary language for data scientists, but it plays a vital role in providing the underlying infrastructure for training and deploying large AI models.

Vulnerability details: Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container’s /dev/null as a file mask.

Remedy: This issue is fixed in version 0.5.7.

Official announcement: Please refer to the link for details –

https://www.tenable.com/cve/CVE-2025-62161

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.