top of page

High-Severity runC Vulnerabilities Create Pathways for Container Escape and Host Compromise

November 14th, 2025

High

Our Cyber Threat Intelligence Unit is monitoring a cluster of three high-severity vulnerabilities in the runC container runtime (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) that allow attackers to bypass container isolation and gain elevated host privileges. Disclosed in early November 2025, these issues involve unsafe mount handling, symlink-based race conditions, and procfs write redirects during container startup. Since runC is the default runtime for Docker, Kubernetes (via containerd), and many managed container platforms, unpatched systems face an immediate risk of container escape and host compromise, even when kernel vulnerabilities are not present. 

Technical Details

  • Attack Type: Container isolation bypass → local privilege escalation → host compromise

  • Severity: High

  • CVE IDs: CVE-2025-31133, CVE-2025-52565, CVE-2025-52881

  • Root Cause: Weak validation of mounts and symbolic links in the runC runtime allows attackers to exploit mount-time race conditions and redirect runC’s privileged operations against host /proc files instead of the container’s isolated view.

    • In CVE-2025-52881, an incomplete fix for an earlier vulnerability also introduces arbitrary-write gadgets and procfs write redirects that can be abused for container escape or denial-of-service.

  • Attack Techniques:

    • Symlink-based masked path abuse: Swapping /dev/null or other masked paths with symlinks to coerce runC into performing privileged bind-mounts into attacker-chosen locations, including host /proc.

    • /dev/console mount races: Manipulating the /dev/pts/$n → /dev/console bind sequence to redirect device mounts to malicious symlinks before maskedPaths and readonlyPaths protections take effect.

    • Procfs write redirect primitives: Using mount propagation and incomplete fix logic to direct runC’s file operations toward sensitive host /proc paths such as core_pattern or sysrq-trigger, allowing privilege escalation, node disruption, or full escape.

  • Affected Components:

    • runC binaries used by Docker Engine, containerd, CRI-O, Kubernetes node runtimes, managed Kubernetes services, and any orchestration or tooling that delegates container creation to runC.

    • Multiple runC versions are affected across distributions; organizations should validate the runC/containerd/Docker package versions deployed on their nodes against vendor advisories.

  • Patch Status:

    • Upstream fixes are available in runC 1.2.8, 1.3.3, and 1.4.0-rc.3 and later.

    • Vendor advisories include Ubuntu USN-7851-1, SUSE SU-2025:3951-1, AWS-2025-024.

    • Updated containerd/Docker packages were published in November 2025.

      • Hosts require a runtime restart after patching.

Image by ThisisEngineering

Impact

  • Successful exploitation allows code executing inside a container to obtain write access to critical host /proc files and escalate to root on the underlying node.

  • Once a node is compromised, attackers can:

    • Pivot laterally across Kubernetes/Docker clusters.

    • Access container secrets and service credentials.

    • Disrupt orchestration components (kubelet, Docker daemon, containerd).

    • Destroy workloads and backups or trigger node-wide crashes/outages.

  • Cloud and multi-tenant environments are at elevated risk where untrusted container workloads share host resources, facilitating potential cross-tenant compromise if containers are used as a security boundary.


Detection Method

  • Runtime & Log Anomalies:

    • Unexpected mount operations or repeated mount failures in:

      • Docker daemon logs

      • containerd logs

      • journalctl and /var/log/syslog

    • runC panics or stack traces involving /dev/null, /dev/pts/, /dev/console, or /proc.

  • Host /proc Write Monitoring:

    • Alerts on containerized processes writing to host /proc paths:

      • /proc/sys/kernel/core_pattern

      • /proc/sysrq-trigger

      • Other /proc/sys/* tunables

    • Example audit rule: auditctl -w /proc -p wa -k suspicious_proc_write

  • Suspicious Process Behavior:

    • Containers spawning unexpected host-level utilities or inheriting privileged UIDs.

    • Processes escaping cgroup limitations or appearing outside expected namespaces.

  • Node & Orchestration Signals:

    • Unexpected node reboots, kernel panics, or kubelet mount errors.

    • Repeated container startup failures following mount operations.

  • Post-Patch Verification:

    • Restart runtimes (Docker/containerd) and workloads after patching.

    • If compromise is suspected, cordon/drain and rebuild the node rather than attempting in-place cleanup.

Indicators of Compromise

There are No Indicators of Compromise (IOCs) for this Advisory.

mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

  • Patch immediately:

    • Apply updated runC/containerd/Docker packages from:

      • Upstream runC (≥ 1.2.8 / 1.3.3 / 1.4.0-rc.3)

      • Distro advisories (e.g., Ubuntu USN-7851-1, SUSE-SU-2025:3951-1)

      • Cloud provider images (e.g., AWS-2025-024, managed K8s node images)

    • Prioritize hosts running untrusted or internet-facing containers and nodes with exposed management APIs.

  • Hardening Controls:

    • Eliminate or tightly restrict --privileged containers, broad --cap-add usage, and HostPath mounts, especially writable paths.

    • Use read-only mounts whenever host directories must be exposed.

  • CI/CD & Image Security:

    • Enforce image signing and registry policies.

    • Block Dockerfiles with unusual mount directives or device manipulations.

    • Integrate scanning and policy checks before deployment.

  • Access & API Restrictions:

    • Limit access to Docker socket (/var/run/docker.sock) and Kubernetes API server / CRI endpoint.

    • Enforce strict RBAC, network policies, and MFA for administrative interfaces.

  • Monitoring & Response:

    • Deploy runtime security tools (Falco, OSSEC, eBPF-based sensors) to detect mount anomalies, Symlink swaps targeting device paths, and abnormal /proc writes

    • Maintain clear procedures to isolate compromised containers and reimage affected nodes.

  • Test backups & incident response:

    • Validate that cluster backup and recovery workflows support rapid node reprovisioning and restoration of control-plane and workload state after a container escape.

    • Ensure IR playbooks explicitly cover container escape/runtime vulns and coordinate between platform, SRE, and security teams.

Conclusion

The runC vulnerabilities CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 form a high-impact vulnerability cluster that allows container escape by exploiting mount-time race conditions, symlink manipulation, and procfs write redirects. Given runC’s role across Docker, containerd, and Kubernetes infrastructures, the operational blast radius extends to multi-tenant clusters, cloud environments, and production workloads. To minimize the risk of host compromise and lateral movement across containerized environments, we urge organizations to apply patches immediately, eliminate risky mount/privilege configurations, harden CI/CD pipelines, and implement active monitoring for mount and /proc-level anomalies.

bottom of page