CVE-2025-31133
Description
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
How to fix
- linuxfoundation runc1.2.8, 1.3.3 or later
- github.com/opencontainers/runc1.2.8, 1.3.3, 1.4.0-rc.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation runc | v < 1.2.8, 1.3.0 ≤ v < 1.3.3, 1.4.0 | 1.2.8, 1.3.3 |
| github.com/opencontainers/runcGo | v < 1.2.8, 1.3.0-rc.1 ≤ v < 1.3.3, 1.4.0-rc.1 ≤ v < 1.4.0-rc.3 | 1.2.8, 1.3.3, 1.4.0-rc.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.