Critical Security Flaw in runc: Container Escape Vulnerabilities
Summary
ALSA-2025:19927: Important: runc security update. Affects runc versions < 4:1.2.5-3.el9_6. Fixed in 4:1.2.5-3.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a lightweight, portable implementation of the Open Container Format (OCF) that serves as a container runtime. It is widely used in various container orchestration systems to create and manage containerized applications. The tool is designed to be efficient and secure, but vulnerabilities can expose containers to security risks, potentially allowing unauthorized access or control over the host system.
Vulnerability Detail
The vulnerabilities in runc stem from several issues that can lead to container escape, allowing an attacker to break out of the container's isolation. The first vulnerability involves 'masked path' abuse due to mount race conditions (CVE-2025-31133), which can be exploited to gain unauthorized access to the host filesystem. The second vulnerability relates to a malicious configuration that allows access to /dev/console and associated race conditions (CVE-2025-52565). Lastly, arbitrary write gadgets and procfs write redirects can lead to denial of service and further container escape (CVE-2025-52881). These vulnerabilities can have severe ramifications, including unauthorized data access and system compromise.
How To Fix
Minimum fixed version
4:1.2.5-3.el9_6
This is the first release that contains the fix.
sudo dnf update runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While waiting for the patch, consider isolating containers more strictly by limiting their permissions and capabilities. Additionally, avoid using configurations that expose sensitive paths or devices to the container.
Conclusion
The vulnerabilities in runc pose significant security risks that can lead to container escape and unauthorized access to host systems. It is crucial to update to the latest patched version to mitigate these risks. Implementing workarounds can provide temporary relief, but a permanent fix through updates is recommended.
See every vulnerability recorded for runc →
FAQ
runc is a lightweight container runtime that implements the Open Container Format, allowing users to create and manage containers efficiently.
The vulnerabilities can lead to container escape, allowing attackers to access the host system, potentially compromising sensitive data and services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing stricter isolation measures for your containers and avoid exposing sensitive paths.
For detailed information, refer to the CVE pages linked in the advisory, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
