CVE-2025-31133
📋 TL;DR
This vulnerability in runc allows attackers to bypass container isolation by exploiting insufficient verification of bind-mount sources when using /dev/null to mask files. Attackers can potentially escape containers, access host filesystems, cause denial of service, or bypass security controls. This affects all systems using vulnerable runc versions for container management.
💻 Affected Systems
- runc
- Docker
- containerd
- Kubernetes (when using affected runc versions)
- Podman
📦 What is this software?
Runc by Linuxfoundation
Runc by Linuxfoundation
Runc by Linuxfoundation
Runc by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Container escape leading to full host compromise, data exfiltration, and lateral movement across infrastructure
Likely Case
Information disclosure from host filesystem or container escape in multi-tenant environments
If Mitigated
Limited impact if containers run with minimal privileges and proper isolation controls
🎯 Exploit Status
Requires ability to create or control containers; exploit details not publicly available but technical analysis exists in advisory
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: runc 1.2.8, 1.3.3, 1.4.0-rc.3 and later
Vendor Advisory: https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
Restart Required: Yes
Instructions:
1. Update runc to patched version using package manager (apt/yum) or manual install. 2. Update container runtime (Docker/containerd) to versions using patched runc. 3. Restart container runtime service. 4. Recreate containers to ensure they use updated runc.
🔧 Temporary Workarounds
Disable bind-mount masking
linuxPrevent use of container's /dev/null for masking by modifying container configurations
Modify container runtime configuration to avoid maskedPaths using /dev/null
🧯 If You Can't Patch
- Implement strict container privilege restrictions (no privileged containers, drop all capabilities)
- Use seccomp profiles and AppArmor/SELinux policies to limit container capabilities
🔍 How to Verify
Check if Vulnerable:
Check runc version: runc --version | grep versionCheck Version:
runc --versionVerify Fix Applied:
Verify runc version is 1.2.8+, 1.3.3+, or 1.4.0-rc.3+📡 Detection & Monitoring
Log Indicators:
- Unusual bind-mount operations in container runtime logs
- Container escape attempts in kernel/audit logs
Network Indicators:
- Containers making unexpected network connections to host services
SIEM Query:
container.runtime=runc AND (version < 1.2.8 OR (version >= 1.3.0 AND version <= 1.3.1) OR version = 1.4.0-rc.1 OR version = 1.4.0-rc.2)🔗 References
- https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522
- https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66
- https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
