Skip to main content

UNIX Symbolic Link (Symlink) Following in github.com/opencontainers/runc

CVE-2025-31133

  • github.com/opencontainers/runc
High
7.3/10

Summary

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions through 1.2.7, 1.3.0-rc.1 through 1.3.2, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real "/dev/null" inode when using the container's "/dev/null" to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host Denial-of Service (DoS), container escape, or a bypassing of "maskedPaths". This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

  • HIGH
  • LOCAL
  • HIGH
  • CHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-61 - UNIX Symbolic Link (Symlink) Following

The software, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the software to operate on unauthorized files.

References

Advisory Timeline

  • Published