CVE-2025-31133
BaseFortify
Publication date: 2025-11-06
Last updated on: 2025-12-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | runc | to 1.2.8 (exc) |
| linuxfoundation | runc | From 1.3.0 (inc) to 1.3.3 (exc) |
| linuxfoundation | runc | 1.4.0 |
| linuxfoundation | runc | 1.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-363 | The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file. |
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in runc occurs because the tool does not sufficiently verify that the source of a bind-mount, specifically the container's /dev/null, is actually a real /dev/null inode. This allows attackers to use the container's /dev/null to mask other mounts, enabling arbitrary mount gadgets. As a result, attackers can cause host information disclosure, host denial of service, container escape, or bypass maskedPaths protections.
How can this vulnerability impact me? :
The vulnerability can lead to serious impacts including disclosure of sensitive host information, denial of service on the host system, escape from the container environment to the host, and bypassing of security mechanisms like maskedPaths. These impacts can compromise the security and stability of containerized environments and the underlying host.
What immediate steps should I take to mitigate this vulnerability?
Upgrade runc to version 1.2.8, 1.3.3, or 1.4.0-rc.3 or later, as these versions contain the fix for this vulnerability.