Sourced from github.com/opencontainers/runc's releases.
runc v1.2.8 -- "鳥籠の中に囚われた屈辱を"
[!NOTE] Some vendors were given a pre-release version of this release. This public release includes two extra patches to fix regressions discovered very late during the embargo period and were thus not included in the pre-release versions. Please update to this version.
This release contains fixes for three high-severity security vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881). All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary
/procfiles.Security
CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's
/dev/nullinode on top of the file. However, if an attacker can replace/dev/nullwith a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in
/dev/consolebind-mounts. When creating the/dev/consolebind-mount (to/dev/pts/$n), if an attacker replaces/dev/pts/$nwith a symlink then runc will bind-mount the symlink target over/dev/console. This issue affected all versions of runc >= 1.0.0-rc3.CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.
Static Linking Notices
The
runcbinary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, withruncacting as a "work that uses the Library":
... (truncated)
Sourced from github.com/opencontainers/runc's changelog.
[1.2.8] - 2025-11-05
鳥籠の中に囚われた屈辱を
Security
This release includes fixes for the following high-severity security issues:
CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's
/dev/nullinode on top of the file. However, if an attacker can replace/dev/nullwith a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in
/dev/consolebind-mounts. When creating the/dev/consolebind-mount (to/dev/pts/$n), if an attacker replaces/dev/pts/$nwith a symlink then runc will bind-mount the symlink target over/dev/console. This issue affected all versions of runc >= 1.0.0-rc3.CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.
[1.2.7] - 2025-09-05
さんをつけろよデコ助野郎！
Fixed
- Removed preemptive "full access to cgroups" warning when calling
runc pauseorrunc unpauseas an unprivileged user without--systemd-cgroups. Now the warning is only emitted if an actual permission error was encountered. (#4709, #4720)- Add time namespace to container config after checkpoint/restore. CRIU since version 3.14 uses a time namespace for checkpoint/restore, however it was not joining the time namespace in runc. (#4696, #4714)
- Container processes will no longer inherit the CPU affinity of runc by default. Instead, the default CPU affinity of container processes will be the largest set of CPUs permitted by the container's cpuset cgroup and any other system restrictions (such as isolated CPUs). (#4041, #4815, #4858)
... (truncated)
eeb7e60
VERSION: release v1.2.8cdee962
merge private security patches into ghsa-release-1.2.8b4cb2f5
rootfs: re-allow dangling symlinks in mount targetsee56b85
openat2: improve resilience on busy systems2462b68
Merge pull request #4943
from lifubang/backport-1.2-4934-493799e41a5
ci: only run lint-extra job on PRs to mainf2a1c98
CI: remove deprecated lima-vm/lima-actions/ssh8f90185
selinux: use safe procfs API for labels948d6e9
rootfs: switch to fd-based handling of mountpoint targets7aa42ad
libct: align param type for mountCgroupV1/V2 functions