Read the docs
TI-2025-22394 Aliases CVE-2025-31133GHSA-9493-h29p-rfm2

runc container escape via "masked path" abuse due to mount race conditions

Priority LOW 37CWE-363Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01245 69th percentileScored 2026-11-07
Fix Fixed runc (opencontainers): 1.2.8, 1.3.3github.com/opencontainers/runc (Go): 1.2.8, 1.3.3, 1.4.0-rc.3Red Hat: 22 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstageruncbefore 1.2.8; 1.3.0-rc.1 to before 1.3.3; 1.4.0-rc.1 – 1.4.0-rc.31.2.8, 1.3.3Patch availableCNA
—github.com/opencontainers/runc (Go)before 1.2.81.2.8Patch availableGHSA-9493-h29p-rfm2
—github.com/opencontainers/runc (Go)1.3.0-rc.1 to before 1.3.31.3.3Patch availableGHSA-9493-h29p-rfm2
—github.com/opencontainers/runc (Go)1.4.0-rc.1 to before 1.4.0-rc.31.4.0-rc.3Patch availableGHSA-9493-h29p-rfm2
  • runc Vendorbackstage Affected before 1.2.8; 1.3.0-rc.1 to before 1.3.3; 1.4.0-rc.1 – 1.4.0-rc.3 Fixed in 1.2.8, 1.3.3 Patch available CNA
  • github.com/opencontainers/runc (Go) Vendor— Affected before 1.2.8 Fixed in 1.2.8 Patch available GHSA-9493-h29p-rfm2
  • github.com/opencontainers/runc (Go) Vendor— Affected 1.3.0-rc.1 to before 1.3.3 Fixed in 1.3.3 Patch available GHSA-9493-h29p-rfm2
  • github.com/opencontainers/runc (Go) Vendor— Affected 1.4.0-rc.1 to before 1.4.0-rc.3 Fixed in 1.4.0-rc.3 Patch available GHSA-9493-h29p-rfm2

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*before 1.2.8; 1.3.0 to before 1.3.3Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.4.0:rc1:*:*:*:*:*:*1.4.0 rc1Vulnerablebackstage
cpe:2.3:a:linuxfoundation:runc:1.4.0:rc2:*:*:*:*:*:*1.4.0 rc2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions before 1.2.8; 1.3.0 to before 1.3.3 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.4.0:rc1:*:*:*:*:*:* Versions 1.4.0 rc1 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:runc:1.4.0:rc2:*:*:*:*:*:* Versions 1.4.0 rc2 Vulnerable ·backstage

Remediation

  • Fix · CNA runc (opencontainers) Fixed in 1.2.8, 1.3.3
  • Fix · GHSA-9493-h29p-rfm2 github.com/opencontainers/runc (Go) Fixed in 1.2.8 Advisory →
  • Fix · GHSA-9493-h29p-rfm2 github.com/opencontainers/runc (Go) Fixed in 1.3.3 Advisory →
  • Fix · GHSA-9493-h29p-rfm2 github.com/opencontainers/runc (Go) Fixed in 1.4.0-rc.3 Advisory →

Red Hat 22 advisories

  • RHSA-2026:10703 Released 2026-04-27 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.src::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.aarch64::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.ppc64le::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.s390x::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.src::container-tools:rhel8, buildah-1:1.26.10-1.module+el8.6.0+24209+25a14987.x86_64::container-tools:rhel8 +47
  • RHSA-2026:8325 Released 2026-04-15 · Red Hat rating Important
    buildah, crun, podman, runc, and skopeo security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) buildah-1:1.26.9-1.el9_0.3, buildah-tests-1:1.26.9-1.el9_0.3, podman-2:4.2.0-6.el9_0.6 +9
  • RHSA-2026:6492 Released 2026-04-09 · Red Hat rating Important
    OpenShift Container Platform 4.12.87 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202604010116-0
Show 19 more Red Hat advisories
  • RHSA-2026:4693 Released 2026-03-17 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8, buildah-1:1.29.7-1.module+el8.8.0+24026+ca15dd94.src::container-tools:rhel8 +47
  • RHSA-2026:4531 Released 2026-03-12 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) runc-4:1.2.9-1.el9_2.1
  • RHSA-2026:2681 Released 2026-02-12 · Red Hat rating Important
    Red Hat Quay 3.16.2
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:1540 Released 2026-02-05 · Red Hat rating Important
    OpenShift Container Platform 4.15.61 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.15 python-eventlet-0.33.1-7.el9, python3-eventlet-0.33.1-7.el9
    • Red Hat OpenShift Container Platform 4.15 bpftool-7.0.0-284.155.1.el9_2, kernel-5.14.0-284.155.1.el9_2, kernel-64k-5.14.0-284.155.1.el9_2 +47
  • RHSA-2026:0995 Released 2026-01-30 · Red Hat rating Important
    OpenShift Container Platform 4.14.61 packages and security update
    • Red Hat OpenShift Container Platform 4.14 runc-4:1.2.9-1.rhaos4.16.el8, runc-4:1.2.9-1.rhaos4.16.el9
  • RHSA-2026:0676 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.13.63 packages and security update
    • Red Hat OpenShift Container Platform 4.13 runc-4:1.2.9-1.rhaos4.16.el8, runc-4:1.2.9-1.rhaos4.16.el9
  • RHSA-2026:0701 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.17.47 packages and security update
    • Red Hat OpenShift Container Platform 4.17 runc-4:1.2.9-1.rhaos4.17.el9
  • RHSA-2026:0418 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.16.55 packages and security update
    • Red Hat OpenShift Container Platform 4.16 runc-4:1.2.9-1.rhaos4.16.el8, runc-4:1.2.9-1.rhaos4.16.el9
  • RHSA-2026:0331 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.18.31 packages and security update
    • Red Hat OpenShift Container Platform 4.18 runc-4:1.2.9-1.rhaos4.18.el8, runc-4:1.2.9-1.rhaos4.18.el9
  • RHSA-2026:0315 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.12.84 packages and security update
    • Red Hat OpenShift Container Platform 4.12 runc-4:1.2.9-1.rhaos4.17.el8
  • RHSA-2026:0425 Released 2026-01-12 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) runc-4:1.2.9-1.el9_4
  • RHSA-2025:23113 Released 2026-01-07 · Red Hat rating Important
    OpenShift Container Platform 4.15.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202512100122-0, rhcos-ppc64le-415.92.202512100122-0, rhcos-s390x-415.92.202512100122-0 +1
  • RHSA-2025:22275 Released 2025-12-05 · Red Hat rating Important
    OpenShift Container Platform 4.13.62 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202511261311-0
  • RHSA-2025:21824 Released 2025-11-27 · Red Hat rating Important
    OpenShift Container Platform 4.16.53 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202511191934-0, rhcos-ppc64le-416.94.202511191934-0, rhcos-s390x-416.94.202511191934-0 +1
  • RHSA-2025:21795 Released 2025-11-27 · Red Hat rating Important
    OpenShift Container Platform 4.18.29 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202511170715-0, rhcos-ppc64le-418.94.202511170715-0, rhcos-s390x-418.94.202511170715-0 +1
  • RHSA-2025:21328 Released 2025-11-20 · Red Hat rating Important
    OpenShift Container Platform 4.14.59 packages and security update
    • Red Hat OpenShift Container Platform 4.14 containernetworking-plugins-1:1.4.0-5.rhaos4.14.el8, cri-o-1.27.8-16.rhaos4.14.gite1422c1.el8, cri-o-1.27.8-16.rhaos4.14.gite1422c1.el9 +8
  • RHSA-2025:21232 Released 2025-11-13 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+23647+cfd78660.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+23647+cfd78660.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+23647+cfd78660.s390x::container-tools:rhel8 +47
  • RHSA-2025:20957 Released 2025-11-11 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.3.0-4.el9_7
  • RHSA-2025:19927 Released 2025-11-07 · Red Hat rating Important
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.2.5-3.el9_6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:21232
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:19927, RHSA-2025:20957
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:10703
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:10703
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:4693
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:8325
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:4531
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:0425
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:10703
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:4693
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:0315, RHSA-2026:6492
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:22275, RHSA-2026:0676
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:21328, RHSA-2026:0995
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:23113, RHSA-2026:1540
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:21824, RHSA-2026:0418
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:0701
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:21795, RHSA-2026:0331
Red Hat OpenShift Container Platform 4.19Fixed—
Red Hat OpenShift Container Platform 4.20Fixed—
Red Hat Quay 3.16Fixed RHSA-2026:2681
Not affected: 12 products
  • Ironic content for Red Hat OpenShift Container Platform 4.15
  • Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat Quay 3.16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-31133
  2. 2026-10-03 Alias added: GHSA-9493-h29p-rfm2
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-30 Fix available: Red Hat OpenShift Container Platform 4.19 · Red Hat

References

Patch 5

Advisory 1

Other 1

  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2024-14351 runc container breakout through process.cwd trickery and leaked fds CVSS 3.1HIGH 8.6
  • TI-2021-10869 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. CVSS 3.1HIGH 8.5
  • TI-2019-12591 runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows… CVSS 3.1HIGH 7.5
  • TI-2025-32660 container escape due to /dev/console mount and related races CVSS 4.0HIGH 8.4
  • TI-2025-32917 runc: LSM labels can be bypassed with malicious config using dummy procfs files CVSS 4.0HIGH 7.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences