Vulnerability · Published Nov 6, 2025 · Assigned by GitHub_M
CVE-2025-31133runc container escape via "masked path" abuse due to mount race conditions
High 7.3
In plain English
A high-severity security flaw in runc from opencontainers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)7.3High
Exploit odds (30 days)1.2%top 30.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aardvark-dns | 2:1.10.1-2.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | aardvark-dns | 2:1.10.1-2.module_el8.10.0+4023+db236c53 | ALSA-2025:21232 |
| AlmaLinux:8 | aardvark-dns | 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:21232 |
| AlmaLinux:8 | buildah | 2:1.33.12-2.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | buildah | 2:1.33.12-2.module_el8.10.0+4016+efd18bf8 | ALSA-2025:21232 |
| AlmaLinux:8 | buildah | 2:1.33.12-2.module_el8.10.0+4023+db236c53 | ALSA-2025:21232 |
| AlmaLinux:8 | buildah-tests | 2:1.33.12-2.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | buildah-tests | 2:1.33.12-2.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | cockpit-podman | 84.1-1.module_el8.10.0+4016+efd18bf8 | ALSA-2025:21232 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3970+8445edf6 | ALSA-2025:21232 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | container-selinux | 2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:21232 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.4.0-6.module_el8.10.0+4016+efd18bf8 | ALSA-2025:21232 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.4.0-6.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.4.0-6.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | containers-common | 2:1-82.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | containers-common | 2:1-82.module_el8.10.0+3970+8445edf6 | ALSA-2025:21232 |
| AlmaLinux:8 | containers-common | 2:1-82.module_el8.10.0+3876+e55593a8 | ALSA-2025:21232 |
| AlmaLinux:8 | containers-common | 2:1-82.module_el8.10.0+3901+4b80ecd7 | ALSA-2025:21232 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2025:21232 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3901+4b80ecd7 | ALSA-2025:21232 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2025:21232 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3876+e55593a8 | ALSA-2025:21232 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:21232 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3926+f12484f5 | ALSA-2025:21232 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3970+8445edf6 | ALSA-2025:21232 |
| AlmaLinux:8 | criu-devel | 3.18-5.module_el8.10.0+4016+efd18bf8 | ALSA-2025:21232 |
| AlmaLinux:8 | criu-devel | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2025:21232 |
| AlmaLinux:8 | criu-devel | 3.18-5.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+4016+efd18bf8 | ALSA-2025:21232 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+3970+8445edf6 | ALSA-2025:21232 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+3926+f12484f5 | ALSA-2025:21232 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:21232 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:21232 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2025:21232 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3926+f12484f5 | ALSA-2025:21232 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3792+03eaed9c | ALSA-2025:21232 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:21232 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+4023+db236c53 | ALSA-2025:21232 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3858+6ad51f9f | ALSA-2025:21232 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3876+e55593a8 | ALSA-2025:21232 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3845+87b84552 | ALSA-2025:21232 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:21232 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3970+8445edf6 | ALSA-2025:21232 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+3926+f12484f5 | ALSA-2025:21232 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+4016+efd18bf8 | ALSA-2025:21232 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+4023+db236c53 | ALSA-2025:21232 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+3970+8445edf6 | ALSA-2025:21232 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:21232 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | podman | 4:4.9.4-23.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | podman | 4:4.9.4-23.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | podman-catatonit | 4:4.9.4-23.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | podman-catatonit | 4:4.9.4-23.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | podman-docker | 4:4.9.4-23.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | podman-gvproxy | 4:4.9.4-23.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | podman-gvproxy | 4:4.9.4-23.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | podman-plugins | 4:4.9.4-23.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | podman-plugins | 4:4.9.4-23.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | podman-remote | 4:4.9.4-23.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | podman-remote | 4:4.9.4-23.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | podman-tests | 4:4.9.4-23.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | podman-tests | 4:4.9.4-23.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+3876+e55593a8 | ALSA-2025:21232 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+4023+db236c53 | ALSA-2025:21232 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+3926+f12484f5 | ALSA-2025:21232 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+3970+8445edf6 | ALSA-2025:21232 |
| AlmaLinux:8 | python3-podman | 4.9.0-3.module_el8.10.0+4016+efd18bf8 | ALSA-2025:21232 |
| AlmaLinux:8 | runc | 4:1.2.5-2.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:9 | runc | 4:1.3.0-4.el9_7 | ALSA-2025:20957 |
| AlmaLinux:9 | runc | 4:1.2.5-3.el9_6 | ALSA-2025:19927 |
| AlmaLinux:8 | skopeo | 2:1.14.5-4.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | skopeo | 2:1.14.5-4.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | skopeo-tests | 2:1.14.5-4.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | skopeo-tests | 2:1.14.5-4.module_el8.10.0+4016+efd18bf8 | ALSA-2025:21232 |
| AlmaLinux:8 | skopeo-tests | 2:1.14.5-4.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+4023+db236c53 | ALSA-2025:21232 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3926+f12484f5 | ALSA-2025:21232 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3876+e55593a8 | ALSA-2025:21232 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2025:21232 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3876+e55593a8 | ALSA-2025:21232 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+4047+545787c4 | ALSA-2025:21232 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f | ALSA-2025:21232 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+4023+db236c53 | ALSA-2025:21232 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3909+6e1c1eb7 | ALSA-2025:21232 |
| AlmaLinux:8 | udica | 0.2.6-21.module_el8.10.0+4068+0e21408f | ALSA-2025:21232 |
| Alpine:v3.22 | runc | 1.3.3-r0 | ALPINE-CVE-2025-31133 |
| Alpine:v3.23 | runc | 1.3.3-r0 | ALPINE-CVE-2025-31133 |
| Alpine:v3.24 | runc | 1.3.3-r0 | ALPINE-CVE-2025-31133 |
| Debian:12 | runc | no fix listed | DEBIAN-CVE-2025-31133 |
| Debian:13 | runc | no fix listed | DEBIAN-CVE-2025-31133 |
| Debian:14 | runc | 1.3.3+ds1-2 | DEBIAN-CVE-2025-31133 |
| Go | github.com/opencontainers/runc | 1.2.8, 1.3.3, 1.4.0-rc.3 | GO-2025-4096 |
| Go | github.com/opencontainers/runc | 1.3.3 | GHSA-9493-h29p-rfm2 |
| Go | github.com/opencontainers/runc | 1.4.0-rc.3 | GHSA-9493-h29p-rfm2 |
| Go | github.com/opencontainers/runc | 1.2.8 | GHSA-9493-h29p-rfm2 |
| Rocky Linux:8 | aardvark-dns | 2:1.10.1-2.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | aardvark-dns | 2:1.10.1-2.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | aardvark-dns | 2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | aardvark-dns | 2:1.10.1-2.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | aardvark-dns | 2:1.10.1-2.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | buildah | 2:1.33.12-2.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1872+2e18eb19 | RLSA-2025:21232 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1825+623b0c20 | RLSA-2025:21232 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1843+6892ab28 | RLSA-2025:21232 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:21232 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | conmon | 3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | conmon | 3:2.1.10-1.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | conmon | 3:2.1.10-1.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | conmon | 3:2.1.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:21232 |
| Rocky Linux:8 | conmon | 3:2.1.10-1.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | conmon | 3:2.1.10-1.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | conmon | 3:2.1.10-1.module+el8.10.0+1843+6892ab28 | RLSA-2025:21232 |
| Rocky Linux:8 | conmon | 3:2.1.10-1.module+el8.10.0+1872+2e18eb19 | RLSA-2025:21232 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1872+2e18eb19 | RLSA-2025:21232 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1843+6892ab28 | RLSA-2025:21232 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2025:21232 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1825+623b0c20 | RLSA-2025:21232 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | containernetworking-plugins | 1:1.4.0-6.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | containers-common | 2:1-82.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | containers-common | 2:1-82.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | containers-common | 2:1-82.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | containers-common | 2:1-82.module+el8.10.0+1872+2e18eb19 | RLSA-2025:21232 |
| Rocky Linux:8 | containers-common | 2:1-82.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | containers-common | 2:1-82.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | containers-common | 2:1-82.module+el8.10.0+1843+6892ab28 | RLSA-2025:21232 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+1815+5fe7415e | RLSA-2025:21232 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+1825+623b0c20 | RLSA-2025:21232 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+1843+6892ab28 | RLSA-2025:21232 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+1872+2e18eb19 | RLSA-2025:21232 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+1843+6892ab28 | RLSA-2025:21232 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+1825+623b0c20 | RLSA-2025:21232 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2025:21232 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+1872+2e18eb19 | RLSA-2025:21232 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:21232 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1872+2e18eb19 | RLSA-2025:21232 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1825+623b0c20 | RLSA-2025:21232 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1843+6892ab28 | RLSA-2025:21232 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+1843+6892ab28 | RLSA-2025:21232 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+1872+2e18eb19 | RLSA-2025:21232 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2025:21232 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+1825+623b0c20 | RLSA-2025:21232 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:21232 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+1872+2e18eb19 | RLSA-2025:21232 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+1825+623b0c20 | RLSA-2025:21232 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+1843+6892ab28 | RLSA-2025:21232 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1843+6892ab28 | RLSA-2025:21232 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2025:21232 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1880+8e896d1b | RLSA-2025:21232 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1825+623b0c20 | RLSA-2025:21232 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1872+2e18eb19 | RLSA-2025:21232 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1874+ce489889 | RLSA-2025:21232 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | podman | 4:4.9.4-23.module+el8.10.0+2064+309a12a4 | RLSA-2025:21232 |
| Rocky Linux:8 | python-podman | 0:4.9.0-3.module+el8.10.0+2001+6a33db9f | RLSA-2025:21232 |
| Rocky Linux:8 | python-podman | 0:4.9.0-3.module+el8.10.0+1896+b18fa106 | RLSA-2025:21232 |
| Rocky Linux:8 | python-podman | 0:4.9.0-3.module+el8.10.0+1948+4b5cd4a9 | RLSA-2025:21232 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| opencontainers | runc | < 1.2.8>= 1.3.0-rc.1, < 1.3.3>= 1.4.0-rc.1, <= 1.4.0-rc.3 |
Weakness: CWE-61, CWE-363 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2 x_refsource_CONFIRM
- https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522 x_refsource_MISC
- https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66 x_refsource_MISC
- https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f x_refsource_MISC
- https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64 x_refsource_MISC