CVE-2025-31133

Executive Summary

CVE-2025-31133 is a high-severity vulnerability in runc, the container runtime used by Docker, containerd, and other OCI-compliant container platforms. The flaw resides in how runc handles bind-mounts when masking container paths (e.g., /dev/null). An attacker with the ability to create containers (e.g., in a multi-tenant Kubernetes cluster or CI/CD pipeline) can exploit this to mount arbitrary host files into the container, leading to host information disclosure, denial of service, container escape, or bypassing of maskedPaths security features.

The vulnerability affects runc versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, and 1.4.0-rc.1 through 1.4.0-rc.2. Patches are available in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

Supply Chain & Package Security

This vulnerability affects the Go-based runc package, which is a critical component of the container ecosystem. Organizations using Docker, containerd, or any OCI-compliant runtime should treat this as a supply chain risk. The package is distributed via GitHub releases and is often included in base container images. Compromised runc binaries could lead to widespread container escape attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Local (requires ability to run containers)
• Attack Complexity: Low
• Privileges Required: Low (container creation)
• User Interaction: None
• Scope: Changed (host impact)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical for multi-tenant environments. The vulnerability allows a low-privileged container user to escape to the host.

Deep Dive & Mechanics

The vulnerability lies in runc's maskPath function, which is used to mask sensitive host paths (like /proc or /sys) inside containers. When a container requests a bind-mount to /dev/null (e.g., to mask a file), runc does not verify that the source of the bind-mount is actually the host's /dev/null inode. An attacker can craft a container configuration that uses a symlink or other trick to point the bind-mount to an arbitrary host file.

Attack Methods:

1. Arbitrary Mount Gadget: By manipulating the container's /dev/null to point to a host file (e.g., /etc/shadow), the attacker can read or write to that file from within the container.
2. MaskedPaths Bypass: The attacker can bypass the maskedPaths feature, which is supposed to prevent access to sensitive host paths.

The root cause is a missing inode verification step. The fix adds a check that the source of the bind-mount is indeed a /dev/null inode (character device with major/minor numbers 1,3).

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

func maskPath(rootfs, path string) error {
    // No verification that source is /dev/null
    return unix.Mount("/dev/null", filepath.Join(rootfs, path), "", unix.MS_BIND, "")
}

Patched Code (simplified):

func maskPath(rootfs, path string) error {
    // Verify that /dev/null is a real /dev/null inode
    var stat unix.Stat_t
    if err := unix.Stat("/dev/null", &stat); err != nil {
        return err
    }
    if stat.Rdev != unix.Mkdev(1, 3) {
        return fmt.Errorf("/dev/null is not a real /dev/null")
    }
    return unix.Mount("/dev/null", filepath.Join(rootfs, path), "", unix.MS_BIND, "")
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Ability to create a container with a custom config.json (e.g., using runc spec).
• The container must have a bind-mount to /dev/null that points to a host file.

Exploit Steps:

1. Create a malicious container configuration that uses a symlink to redirect /dev/null to a host file.
2. Use runc run to start the container.
3. Inside the container, read or write to the mounted host file.

Example (conceptual):

# Create a symlink in the container's rootfs
ln -s /etc/shadow /container/rootfs/dev/null

# Run the container with a bind-mount that uses /dev/null as source
runc run malicious-container

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor for containers that attempt to mount /dev/null with unusual source paths.
• Audit container configurations for bind-mounts that use /dev/null as a source.
• Use eBPF or auditd to detect unexpected mount syscalls from container runtimes.

Hunting:

• Search for containers with maskedPaths that include /dev/null but have unusual mount sources.
• Check for symlinks in container root filesystems that point to host files.

Indicators of Compromise (IOCs)

• File System: Unexpected symlinks in container rootfs pointing to host files (e.g., /dev/null -> /etc/shadow).
• Process: runc processes with unusual mount arguments.
• Network: Outbound connections from containers that should not have network access (post-escape).
• Logs: Audit logs showing mount syscalls with source /dev/null and target inside container.

Detection Engineering

YARA Rule

rule CVE_2025_31133_runc_mount_bypass {
    meta:
        description = "Detects runc configurations attempting to exploit CVE-2025-31133"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31133"
    strings:
        $mount_null = "/dev/null" nocase
        $masked_path = "maskedPaths" nocase
        $bind_mount = "bind" nocase
    condition:
        $mount_null and $masked_path and $bind_mount
}

Sigma Rule

title: CVE-2025-31133 - runc Bind Mount Verification Bypass
id: cve-2025-31133
status: experimental
description: Detects potential exploitation of CVE-2025-31133 via unusual mount sources
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/runc'
        CommandLine|contains: 'mount'
        CommandLine|contains: '/dev/null'
    condition: selection
falsepositives:
    - Legitimate container operations using /dev/null
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-31133 - runc Mount Exploit Attempt"; content:"/dev/null"; offset:0; depth:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade runc to version 1.2.8, 1.3.3, or 1.4.0-rc.3 (or later).
2. For Docker users: sudo apt-get update && sudo apt-get install docker-ce (or equivalent).
3. For containerd users: Update containerd package which bundles runc.

Mitigation (if patching is not possible):

• Restrict container creation to trusted users only.
• Use Pod Security Standards (PSS) to prevent privileged containers.
• Monitor for unusual mount operations using auditd or Falco.
• Implement seccomp profiles that block mount syscalls for non-privileged containers.

Long-term:

• Implement runtime security monitoring (e.g., Falco, Tracee) to detect container escape attempts.
• Regularly audit container configurations for insecure bind-mounts.

Valters IT