CVE-2025-31133: runc Container Escape via Masked Path Abuse and Mount Race Conditions
Summary
CVE-2025-31133: runc container escape via "masked path" abuse due to mount race conditions. Affects github.com/opencontainers/runc across 3 version ranges.
< 1.2.8
>= 1.3.0-rc.1, < 1.3.3
>= 1.4.0-rc.1, < 1.4.0-rc.3
Fixed in 1.2.8, 1.3.3 or 1.4.0-rc.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is an Open Container Initiative (OCI) compliant runtime for running containers. It provides a lightweight and efficient way to manage container lifecycles, including creation, execution, and destruction. runc is widely used in various container orchestration systems, such as Docker and Kubernetes. However, it has a vulnerability related to its 'maskedPaths' feature, which is intended to protect sensitive host information from being accessed by containers. This vulnerability arises from insufficient verification during the masking process, making it susceptible to exploitation.
Vulnerability Detail
The vulnerability in runc stems from its handling of the 'maskedPaths' feature, which allows files or directories to be concealed by mounting over them. In all known versions of runc, the verification of the source of the bind-mount (specifically, the container's /dev/null) is inadequate. An attacker can exploit this by creating a symlink to an attacker-controlled path, leading to arbitrary mount gadgets that can disclose host information, cause denial of service, or allow container escape. Additionally, the validation mechanism ignores ENOENT errors, which can allow attackers to bypass the masking entirely, granting access to sensitive files in /proc that should be protected.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.2.81.2.8go get github.com/opencontainers/runc@v1.2.8 -
>= 1.3.0-rc.1, < 1.3.31.3.3go get github.com/opencontainers/runc@v1.3.3 -
>= 1.4.0-rc.1, < 1.4.0-rc.31.4.0-rc.3go get github.com/opencontainers/runc@v1.4.0-rc.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider using containers with user namespaces, which can mitigate the impact of this vulnerability. This configuration prevents privileged access to sensitive files in /proc. Additionally, avoid running untrusted container images from unknown sources and configure containers to not allow root privileges.
Conclusion
The vulnerability CVE-2025-31133 in runc poses significant risks to container security by allowing potential container escapes and host information disclosure. Users are strongly advised to update to the patched versions of runc and implement recommended workarounds to mitigate risks until they can apply the updates.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
CVE-2025-31133 is a vulnerability in runc that allows attackers to exploit the 'maskedPaths' feature, leading to potential container escapes and host information disclosure.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include host denial of service, unauthorized access to sensitive information, and potential container escape, allowing attackers to gain root privileges on the host system.
If immediate updates are not possible, implement workarounds such as using user namespaces, avoiding untrusted images, and configuring containers to run without root privileges.
Yes, other OCI runtimes like crun and youki may have similar vulnerabilities. It is advisable to monitor their security advisories for updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
