OCI Fixes Container Escape Vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881)

OCI has released security updates to fix three high-severity vulnerabilities in runc, tracked as CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, which could allow container escape, denial of service, or privilege escalation on the host. The flaws affect all runc versions up to 1.2.7, 1.3.2, and 1.4.0-rc.2, and have been patched in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

CVE-2025-31133 concerns a maskedPath race condition that could enable container escape, with potential attacks such as binding /proc/sysrq-trigger or reconfiguring /proc/sys/kernel/core_pattern. CVE-2025-52565 involves bind-mounts of /dev/pts/$n to /dev/console, which could be exploited during mounting to cause either a host DoS or privilege escalation.

CVE-2025-52881 describes arbitrary write gadgets and an LSM bypass, increasing the risk of code execution with root privileges by redirecting writes to critical kernel paths. According to OCI’s advisory, applying mitigations such as enabling user namespaces, using non-root or rootless containers, and avoiding untrusted images can help limit the impact while patches are deployed.