Critical runc Vulnerabilities Put Docker and Kubernetes Container Isolation at Risk

Three critical vulnerabilities in runc, the container runtime powering Docker, Kubernetes, and other containerization platforms.

These flaws could allow attackers to escape container isolation and gain root access to host systems. However, no active exploits have been detected yet.

The vulnerabilities leverage race mount conditions and procfs write redirects to break out of container boundaries.

Attackers need the ability to start containers with custom mount configurations, making malicious container images and Dockerfiles the primary attack vectors.

The Sysdig Threat Research Team analyzed all three vulnerabilities and provided detailed mitigation recommendations for affected organizations worldwide.

runc Vulnerabilities Lead to Container Isolation

CVE-2025-31133 exploits weaknesses in runc’s maskedPaths feature, which protects sensitive host files from container access.

By replacing /dev/null with a symlink during container creation, attackers can trick runc into mounting arbitrary host paths and writing to critical system files, such as /proc/sys/kernel/core_pattern, thereby enabling container escape.

CVE-2025-52565 targets the /dev/console mount operation during container initialization.

Insufficient validation allows attackers to redirect mounts and gain write access to protected procfs files.

The attack succeeds because the mount happens before maskedPaths and readonlyPaths protections are correctly applied.

CVE-2025-52881 enables attackers to bypass Linux Security Module protections through race conditions with shared mounts.

Attackers can redirect runc writes to fake procfs files and manipulate dangerous system files such as/proc/sysrq-trigger or /proc/sys/kernel/core_pattern, potentially crashing systems or escaping from containers.

CVE ID	Vulnerability Type	Affected Versions	Fixed Versions
CVE-2025-31133	Container escape via maskedPaths abuse	All known versions	1.2.8, 1.3.3, 1.4.0-rc.3+
CVE-2025-52565	Container escape via /dev/console mount races	1.0.0-rc3 and later	1.2.8, 1.3.3, 1.4.0-rc.3+
CVE-2025-52881	LSM bypass and arbitrary write gadgets	All known versions	1.2.8, 1.3.3, 1.4.0-rc.3+

Affected Versions and Patches

CVE-2025-31133 and CVE-2025-52881 impact all known runc versions, while CVE-2025-52565 affects versions 1.0.0-rc3 and later.

All three vulnerabilities are patched in runc versions 1.2.8, 1.3.3, and 1.4.0-rc.3 or later.

Organizations using containerized environments should immediately update Runc to patched versions.

The Sysdig Threat Research Team recommends enabling user namespaces for all containers, which blocks critical attack vectors by restricting access to the procfs file system.

Using rootless containers further limits the scope of vulnerability. Cloud providers, including AWS, ECS, and EKS, released security updates on November 5, 2025.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.