Critical runc Vulnerabilities Put Docker and Kubernetes Container Isolation at Risk
Three critical vulnerabilities in runc, the container runtime powering Docker, Kubernetes, and other containerization platforms.
Three critical vulnerabilities in runc, the container runtime powering Docker, Kubernetes, and other containerization platforms.
These flaws could allow attackers to escape container isolation and gain root access to host systems. However, no active exploits have been detected yet.
The vulnerabilities leverage race mount conditions and procfs write redirects to break out of container boundaries.
Attackers need the ability to start containers with custom mount configurations, making malicious container images and Dockerfiles the primary attack vectors.
The Sysdig Threat Research Team analyzed all three vulnerabilities and provided detailed mitigation recommendations for affected organizations worldwide.
runc Vulnerabilities Lead to Container Isolation
CVE-2025-31133 exploits weaknesses in runc’s maskedPaths feature, which protects sensitive host files from container access.
By replacing /dev/null with a symlink during container creation, attackers can trick runc into mounting arbitrary host paths and writing to critical system files, such as /proc/sys/kernel/core_pattern, thereby enabling container escape.
Three critical vulnerabilities in runc, the container runtime powering Docker, Kubernetes, and other containerization platforms.
CVE-2025-52565 targets the /dev/console mount operation during container initialization.
multiple vulnerabilities in runc Insufficient validation allows attackers to redirect mounts and gain write access to protected procfs files.
The attack succeeds because the mount happens before maskedPaths and readonlyPaths protections are correctly applied.
CVE-2025-52881 enables attackers to bypass Linux Security Module protections through race conditions with shared mounts.
Attackers can redirect runc writes to fake procfs files and manipulate dangerous system files such as/proc/sysrq-trigger or /proc/sys/kernel/core_pattern, potentially crashing systems or escaping from containers.
CVE IDVulnerability TypeAffected VersionsFixed VersionsCVE-2025-31133Container escape via maskedPaths abuseAll known versions1.2.8, 1.3.3, 1.4.0-rc.3+CVE-2025-52565Container escape via /dev/console mount races1.0.0-rc3 and later1.2.8, 1.3.3, 1.4.0-rc.3+CVE-2025-52881LSM bypass and arbitrary write gadgetsAll known versions1.2.8, 1.3.3, 1.4.0-rc.3+
CVE-2025-31133 and CVE-2025-52881 impact all known runc versions, while CVE-2025-52565 affects versions 1.0.0-rc3 and later.
All three vulnerabilities are Organizations using containerized environments should immediately update Runc to patched versions.
The Sysdig Threat Research Team recommends enabling user namespaces for all containers, which blocks critical attack vectors by restricting access to the procfs file system.
Using rootless containers further limits the scope of vulnerability. Cloud providers, including AWS, ECS, and EKS, released security updates on November 5, 2025.
Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories.
Based on reporting by Cyber Security News.