runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

An update of the runc package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21232 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4077-1 advisory.

    Update to runc v1.3.3. Upstream changelog is available from

      <https://github.com/opencontainers/runc/releases/tag/v1.3.3>. bsc#1252232

      * CVE-2025-31133
      * CVE-2025-52565
      * CVE-2025-52881

    Update to runc v1.3.2. Upstream changelog is available from

    <https://github.com/opencontainers/runc/releases/tag/v1.3.2> bsc#1252110

      - Includes an important fix for the CPUSet translation for cgroupv2.

    Update to runc v1.3.1. Upstream changelog is available from

    <https://github.com/opencontainers/runc/releases/tag/v1.3.1>

    Update to runc v1.3.0. Upstream changelog is available from

    <https://github.com/opencontainers/runc/releases/tag/v1.3.0>

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4079-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252376)
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252376)
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252376)

    Other fixes:
    - podman and buildah with runc 1.3.2 fail with lots of warnings as rootless (bsc#1252543)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4080-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252376)
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252376)
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252376)

    Other fixes:

    - Fix: podman and buildah with runc 1.3.2 fail with lots of warnings as rootless (bsc#1252543)
    - Add symlink to catatonit in /usr/libexec/podman (bsc#1248988)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4081-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252376)
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252376)
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252376)

    Other fixes:

    - Fix: podman and buildah with runc 1.3.2 fail with lots of warnings as rootless (bsc#1252543)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4073-1 advisory.

    Update to runc v1.3.3. Upstream changelog is available from

      <https://github.com/opencontainers/runc/releases/tag/v1.3.3>. bsc#1252232

      * CVE-2025-31133
      * CVE-2025-52565
      * CVE-2025-52881

    Update to runc v1.3.2. Upstream changelog is available from

    <https://github.com/opencontainers/runc/releases/tag/v1.3.2> bsc#1252110

      - Includes an important fix for the CPUSet translation for cgroupv2.

    Update to runc v1.3.1. Upstream changelog is available from

    <https://github.com/opencontainers/runc/releases/tag/v1.3.1>

    Update to runc v1.3.0. Upstream changelog is available from

    <https://github.com/opencontainers/runc/releases/tag/v1.3.0>

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:20957 advisory.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1286 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.3.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-085 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.3.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-082 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.3.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-077 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:19927 advisory.

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)
      * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)
      * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:19927 advisory.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-19927 advisory.

    - fix CVE-2025-31133 CVE-2025-52565 CVE-2025-52881

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3950-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252232).
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252232).
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252232).

    Update to runc v1.2.7.

    - Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.2.7>

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3951-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252232).
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252232).
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252232).

    Update to runc v1.2.7.

    - Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.2.7>

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7851-1 advisory.

    Lei Wang and Li Fubang discovered that runC incorrectly handled masked paths. An attacker could possibly     replace a container's /dev/null with a symlink to some other procfs file and possibly escape a container.
    (CVE-2025-31133)

    Lei Wang and Li Fubang discovered that runC incorrectly handled the /dev/console bind-mounts. An attacker     could potentially exploit this issue to build-mount a symlink and escape a container. (CVE-2025-52565)

    Li Fubang and Tnis Tiigi discovered that the fix for CVE-2019-16884 was incomplete. An attacker could     possibly use this issue to cause a denial of service or escape the container. (CVE-2025-52881)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6a0f63aaab advisory.

    Automatic update for runc-1.3.3-1.fc44.

    ##### **Changelog**

    ```
    * Wed Nov  5 2025 Bradley G Smith <bradley.g.smith@gmail.com> - 2:1.3.3-1
    - Update to release v1.3.3
    - Resolves: rhbz#2411664, rhbz#2411410, rhbz#2411148
    - Resolves: rbhz#2410768, rhbz#2410512, rhbz#2410233
    - Resolves: rhbz#2409818, rhbz#2409561, rhbz#2409284
    - Resolves: rhbz#2408345, rhbz#2408091, rhbz#2407818
    - Security. Fixes CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
    - Upstream new feature

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform     sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a     real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an     arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape,     or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
    (CVE-2025-31133)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
275323	Photon OS 5.0: Runc PHSA-2025-5.0-0676	Nessus	PhotonOS Local Security Checks	high
275300	RHEL 8 : container-tools:rhel8 (RHSA-2025:21232)	Nessus	Red Hat Local Security Checks	high
275293	SUSE SLES12 Security Update : runc (SUSE-SU-2025:4077-1)	Nessus	SuSE Local Security Checks	high
275278	SUSE SLES15 Security Update : podman (SUSE-SU-2025:4079-1)	Nessus	SuSE Local Security Checks	high
275277	SUSE SLES15 Security Update : podman (SUSE-SU-2025:4080-1)	Nessus	SuSE Local Security Checks	high
275274	SUSE SLES15 / openSUSE 15 Security Update : podman (SUSE-SU-2025:4081-1)	Nessus	SuSE Local Security Checks	high
275273	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : runc (SUSE-SU-2025:4073-1)	Nessus	SuSE Local Security Checks	high
274764	RHEL 9 : runc (RHSA-2025:20957)	Nessus	Red Hat Local Security Checks	high
274691	Amazon Linux 2023 : runc (ALAS2023-2025-1286)	Nessus	Amazon Linux Local Security Checks	high
274678	Amazon Linux 2 : runc, --advisory ALAS2DOCKER-2025-085 (ALASDOCKER-2025-085)	Nessus	Amazon Linux Local Security Checks	high
274657	Amazon Linux 2 : runc, --advisory ALAS2ECS-2025-082 (ALASECS-2025-082)	Nessus	Amazon Linux Local Security Checks	high
274639	Amazon Linux 2 : runc, --advisory ALAS2NITRO-ENCLAVES-2025-077 (ALASNITRO-ENCLAVES-2025-077)	Nessus	Amazon Linux Local Security Checks	high
274618	AlmaLinux 9 : runc (ALSA-2025:19927)	Nessus	Alma Linux Local Security Checks	high
274606	RHEL 9 : runc (RHSA-2025:19927)	Nessus	Red Hat Local Security Checks	high
274585	Oracle Linux 9 : runc (ELSA-2025-19927)	Nessus	Oracle Linux Local Security Checks	high
274485	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : runc (SUSE-SU-2025:3950-1)	Nessus	SuSE Local Security Checks	high
274484	SUSE SLES12 Security Update : runc (SUSE-SU-2025:3951-1)	Nessus	SuSE Local Security Checks	high
274388	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : runC vulnerabilities (USN-7851-1)	Nessus	Ubuntu Local Security Checks	high
274068	Fedora 44 : runc (2025-6a0f63aaab)	Nessus	Fedora Local Security Checks	high
272311	Linux Distros Unpatched Vulnerability : CVE-2025-31133	Nessus	Misc.	high

Detections

Analytics

CVE-2025-31133

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high