{"id":"CVE-2025-31133","published":"2025-11-06T18:47:47Z","modified":"2025-11-06T19:22:22Z","title":"runc container escape via \"masked path\" abuse due to mount race conditions","vendor":"opencontainers","product":"runc","tier":"tail","description":{"text":"runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.3,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01245,"percentile":0.69268,"provenance":"source"},"cwes":[{"id":"CWE-61","name":"UNIX Symbolic Link (Symlink) Following"},{"id":"CWE-363","name":"Race Condition Enabling Link Following"}],"references":[{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64","tags":["x_refsource_MISC"]}],"priority":{"score":24.0,"factors":[{"name":"EPSS percentile","points":13.85},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.11}]},"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2025-11-12","earliestUrl":"https://github.com/skynet-f-nvidia/CVE-2025-31133","repos":[{"name":"skynet-f-nvidia/CVE-2025-31133","url":"https://github.com/skynet-f-nvidia/CVE-2025-31133","stars":2,"created":"2025-11-12"},{"name":"scherepiuk/container-escape-ebpf","url":"https://github.com/scherepiuk/container-escape-ebpf","stars":2,"created":"2025-12-31"},{"name":"C-h4ck-0/Learn-about-cve-2025-31133-poc","url":"https://github.com/C-h4ck-0/Learn-about-cve-2025-31133-poc","stars":2,"created":"2026-01-18"}]},"first":{"date":"2025-11-12","source":"PoC-in-GitHub","url":"https://github.com/skynet-f-nvidia/CVE-2025-31133"},"provenance":"source"},"vendorSlug":"opencontainers","affectedVersions":[{"vendor":"opencontainers","product":"runc","versions":["< 1.2.8",">= 1.3.0-rc.1, < 1.3.3",">= 1.4.0-rc.1, <= 1.4.0-rc.3"]}],"affected":[{"ecosystem":"Go","package":"github.com/opencontainers/runc","vulnerableRanges":["<1.2.8",">=1.3.0-rc.1, <1.3.3",">=1.4.0-rc.1, <1.4.0-rc.3"],"patched":["1.2.8","1.3.3","1.4.0-rc.3"],"from":["GHSA-9493-h29p-rfm2","GO-2025-4096"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-37945","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencontainers-runc-cve-2016-9962","parents":[{"from":"CVE-2025-62161","to":"CVE-2025-31133","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-4g74-7cff-xcv8","via":"reference","url":"https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2"}]}],"children":[{"from":"CVE-2025-31133","to":"CVE-2025-52881","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-9493-h29p-rfm2","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-cgrx-mc8f-2prm","via":"reference","url":"https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2"},{"kind":"osv-related","provenance":"source","id":"GO-2025-4098","via":"reference","url":"https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2"}]},{"from":"CVE-2025-31133","to":"CVE-2025-52565","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers tha…","from":"CVE.org","in":"CVE-2025-52565"},{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522","https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66","https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4","https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398"],"basis":"shared file"}]}],"packageHistory":[{"cve":"CVE-2023-28642","published":"2023-03-29","fixed":"1.1.5","kev":false},{"cve":"CVE-2024-21626","published":"2024-01-31","fixed":"1.1.12","kev":false},{"cve":"CVE-2024-45310","published":"2024-09-03","fixed":"1.2.0-rc.3","kev":false,"link":{"from":"CVE-2024-45310","to":"CVE-2025-31133","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/opencontainers/runc","fromFixed":"1.2.0-rc.3","toFixed":"1.2.8","daysApart":429},{"kind":"same-code","provenance":"machine","files":["libcontainer/rootfs_linux.go"],"commits":["https://github.com/opencontainers/runc/commit/63c2908164f3a1daea455bf5bcd8d363d70328c7","https://github.com/opencontainers/runc/commit/8781993968fd964ac723ff5f360b6f259e809a3e","https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522","https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66"],"basis":"shared file"}]}},{"cve":"CVE-2025-31133","published":"2025-11-06","fixed":"1.4.0-rc.3","kev":false},{"cve":"CVE-2025-52565","published":"2025-11-06","fixed":"1.4.0-rc.3","kev":false},{"cve":"CVE-2025-52881","published":"2025-11-06","fixed":"1.4.0-rc.3","kev":false},{"cve":"CVE-2026-41579","published":"2026-07-01","fixed":"1.5.0-rc.3","kev":false}],"package":"Go:github.com/opencontainers/runc"}}