CVE-2025-2713: 
NixOS vulnerability analysis and mitigation

Google gVisor's runsc component exhibited a local privilege escalation vulnerability (CVE-2025-2713) due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. The vulnerability was discovered and disclosed on March 28, 2025, affecting the runsc component of Google gVisor. The issue occurred because the process initially ran with root-like permissions until the first fork (NVD).

The vulnerability has been assigned a CVSS 4.0 Base Score of 6.8 (MEDIUM) with the vector string CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N. The vulnerability is classified under CWE-269 (Improper Privilege Management) and requires local access to exploit (NVD).

The vulnerability allows unprivileged users to access restricted files, potentially leading to unauthorized access to sensitive system resources. The high values for Vulnerability Confidentiality (VC) and System Confidentiality (SC) in the CVSS score indicate significant potential impact on system confidentiality (NVD).

The vulnerability requires local access and low attack complexity to exploit, as indicated by the CVSS metrics (AV:L/AC:L). The privilege requirement is low (PR:L), and no user interaction is needed (UI:N) (NVD).

A fix has been implemented and is available in the Google gVisor repository. The patch can be found in the commit 586c38d70081b13b2ed494cef48e99b93956843e (GitHub Commit).