Three critical vulnerabilities in runc, the container runtime powering Docker, Kubernetes, and other containerization platforms.<\/p>\n
These flaws could allow attackers to escape container isolation and gain root access to host systems. However, no active exploits have been detected yet.<\/p>\n
The vulnerabilities<\/a> leverage race mount conditions and procfs write redirects to break out of container boundaries.<\/p>\n Attackers need the ability to start containers with custom mount<\/a> configurations, making malicious container images and Dockerfiles the primary attack vectors.<\/p>\n The Sysdig Threat Research Team analyzed all three vulnerabilities and provided detailed mitigation recommendations for affected organizations worldwide.<\/p>\n CVE-2025-31133\u00a0exploits weaknesses in runc\u2019s maskedPaths feature, which protects sensitive host files from container access.<\/p>\n By replacing \/dev\/null with a symlink during container creation, attackers can trick runc into mounting arbitrary<\/a> host paths and writing to critical system files, such as \/proc\/sys\/kernel\/core_pattern, thereby enabling container escape.<\/p>\n CVE-2025-52565\u00a0targets the \/dev\/console mount operation during container initialization.<\/p>\n Insufficient validation allows attackers to redirect mounts and gain write access to protected procfs files.<\/p>\n The attack succeeds because the mount happens before maskedPaths and readonlyPaths protections are correctly applied.<\/p>\n CVE-2025-52881\u00a0enables attackers to bypass Linux Security<\/a> Module protections through race conditions with shared mounts.<\/p>\n Attackers can redirect runc writes to fake procfs files and manipulate dangerous system files such as\/proc\/sysrq-trigger or \/proc\/sys\/kernel\/core_pattern, potentially crashing systems or escaping from containers.<\/p>\n\nrunc Vulnerabilities<\/strong> Lead to Container Isolation<\/strong>
\n<\/h2>\n![\"multiple](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgP_H95a4rm7tFvi16jdKgeFuOICsPi4oFoVUaI3KFF-3q9QuoCaLscU_aQzLLcXugn8GqEgAgs3JJpjd4f2a1FtQIpE8nQu3e82RIpgCmDNpRp4t9LDejhJceunRzwy52mCfQ5PwjWbiT6NAhXHRjvpJID0Hv-E8EmMPmQuPJ75CcE8I0YwepHd5_2XdM\/s1600\/Screenshot%25202025-11-10%2520121547%2520%25281%2529.webp?ssl=1\")