{"id":"CVE-2025-31133","revision":"66a339890ac146859562a676d3833588","records":[{"revision":"66a339890ac146859562a676d3833588","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-31133","aliases":[],"title":"runc container escape via \"masked path\" abuse due to mount race conditions","description":"runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.","state":0,"publishedAt":"2025-11-06T18:47:47.335+00:00","modifiedAt":"2025-11-06T19:22:22.047+00:00","affected":[{"ecosystem":"Vendor product","name":"runc","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"opencontainers\",\n                    \"product\": \"runc\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.2.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.3.0-rc.1, < 1.3.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.4.0-rc.1, <= 1.4.0-rc.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":7.3,"severity":"HIGH"}],"references":["https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2","https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522","https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66","https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f","https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-31133","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-31133","identifiers":["CVE-2025-31133"]},"retained":false,"historicalAffected":[]}],"coverage":[]}