Critical Container Escape Vulnerabilities in runc - Important Security Update
Summary
ALSA-2025:20957: Important: runc security update. Affects runc versions < 4:1.3.0-4.el9_7. Fixed in 4:1.3.0-4.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a lightweight, portable implementation of the Open Container Format (OCF) that serves as a container runtime. It is widely used in various container orchestration systems to manage the lifecycle of containers. The tool is designed to create and run containers according to the specifications of the OCF, making it a crucial component in the container ecosystem. However, recent vulnerabilities have been identified that could allow attackers to escape the container environment, posing significant security risks.
Vulnerability Detail
The vulnerabilities in runc stem from various race conditions and improper handling of mounts, which can lead to container escape. Specifically, CVE-2025-31133 allows for container escape via 'masked path' abuse due to mount race conditions. CVE-2025-52565 involves a similar escape with malicious configurations related to the /dev/console mount. Additionally, CVE-2025-52881 enables container escape and denial of service through arbitrary write gadgets and procfs write redirects. These vulnerabilities can allow attackers to gain unauthorized access to the host system, potentially leading to data breaches and system compromise.
How To Fix
Minimum fixed version
4:1.3.0-4.el9_7
This is the first release that contains the fix.
sudo dnf update runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting the use of runc in environments where security is critical until the package can be updated. Additionally, review and limit the configurations that allow for the mounting of sensitive paths or devices within containers.
Conclusion
The identified vulnerabilities in runc pose significant risks to containerized environments, allowing for potential container escapes and unauthorized access to host systems. It is crucial to update to the patched version of runc to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your applications.
See every vulnerability recorded for runc →
FAQ
runc is a lightweight container runtime that implements the Open Container Format, allowing for the creation and management of containers.
The vulnerabilities can lead to container escape, allowing attackers to access the host system and potentially compromise sensitive data.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, consider implementing strict access controls and limiting the use of runc in sensitive environments as a temporary measure.
For more details, refer to the CVE pages listed in the advisory or visit the official runc GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
