runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| linuxfoundation | runc | 1.0.1 – < 1.2.8 | |
| opencontainers | runc | >= 1.0.0-rc3, < 1.2.8, >= 1.3.0-rc.1, < 1.3.3, >= 1.4.0-rc.1, < 1.4.0-rc.3 |
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* ≥ 1.0.1 < 1.2.8cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* ≥ 1.3.0 < 1.3.3cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc7:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc8:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc9:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc90:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc91:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc92:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc93:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc94:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.0.0:rc95:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.4.0:rc1:*:*:*:*:*:*cpe:2.3:a:linuxfoundation:runc:1.4.0:rc2:*:*:*:*:*:*Unser kostenloser Open-Source-Honeypot wartet auf Ports, die Ihr Server nicht nutzt, und meldet verbindende Scanner und Angreifer an eine gemeinsame Blockliste.