DANGEROUS RUNC FLAWS COULD ALLOW HACKERS TO ESCAPE DOCKER CONTAINERS

Summary from the TLDR InfoSec newsletter

Three critical vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) in the runC container runtime used by Docker and Kubernetes allow attackers to exploit symlink races and bind-mount redirections to gain root-level write access to the host system, bypassing container isolation by manipulating /dev/null, /dev/console, and /proc filesystem mounts during container initialization. The flaws affect all runC versions for CVE-2025-31133 and CVE-2025-52881, while CVE-2025-52565 impacts versions 1.0.0-rc3 and later, with patches available in runC versions 1.2.8, 1.3.3, 1.4.0-rc.3 and above. Security teams should immediately update to patched runC versions, enable user namespaces without mapping host root into containers, implement rootless containers where possible, and monitor for suspicious symlink behaviors that could indicate exploitation attempts.