CVE-2025-31133

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-31133
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31133.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-31133
Aliases
Downstream
AZL (3)
BELL (1)
CGA (253)
CLEANSTART (1)
CLSA (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (21)
OESA (1)
openSUSE (9)
RHBA (1)
RHSA (16)
RLSA (2)
SUSE (25)
UBUNTU (1)
Related
ALSA (3)
CGA (1)
openSUSE (9)
SUSE (25)
Published
2025-11-06T18:47:47Z
Modified
2026-08-12T03:51:28Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
runc container escape via "masked path" abuse due to mount race conditions
Details

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-363",
        "CWE-61"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31133.json"
}
References

Affected packages

Git / github.com/opencontainers/runc

Affected ranges

Type
GIT
Repo
https://github.com/opencontainers/runc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eeb7e6024f9ee43876301b1d23c353384fa6dcdd
Introduced
4ca628d1d4c974f92d24daccb901aa078aad748e
Fixed
d842d7719497cc3b774fd71620278ac9e17710e0
Fixed
1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522
Fixed
5d7b2424072449872d1cd0c937f2ca25f418eb66
Fixed
8476df83b534a2522b878c0507b3491def48db9f
Fixed
db19bbed5348847da433faa9d69e9f90192bfa64
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.2.8"
        },
        {
            "introduced":  "1.3.0"
        },
        {
            "fixed":  "1.3.3"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v1.*
v1.0.0-rc2
v1.2.0
v1.2.0-rc.3
v1.3.0-rc.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31133.json"