CVE-2025-31133
HIGHrunc < 1.2.8, 1.3.0-rc.1-1.3.1, 1.4.0-rc.1-1.4.0-rc.2 - Arbitrary Mount Gadget via Insufficient Bind-Mount Verification
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2025-31133. PoCs published by skynet-f-nvidia, sahar042, C-h4ck-0.
AI-analyzed exploit summary This PoC demonstrates a symlink race condition in runc (CVE-2025-31133) by exploiting the maskedPaths feature to modify /proc/sys/kernel/core_pattern. It uses a background process to rapidly replace /dev/null with a symlink to bypass runc's restrictions.
Description
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
Exploits (5)
This PoC demonstrates a symlink race condition in runc (CVE-2025-31133) by exploiting the maskedPaths feature to modify /proc/sys/kernel/core_pattern. It uses a background process to rapidly replace /dev/null with a symlink to bypass runc's restrictions.
This repository contains a functional exploit PoC for CVE-2025-31133, targeting a symlink race condition in runc's maskedPaths feature. The exploit attempts host code execution by manipulating /proc/sys/kernel/core_pattern via a race condition during container startup.
This repository contains a functional proof-of-concept exploit for CVE-2025-31133, a race condition vulnerability in runc that allows bypassing `maskedPaths` protection, potentially leading to container escape. The exploit leverages a timing window during container initialization to write to protected files like `/proc/sys/kernel/core_pattern`.
This repository provides a detailed educational lab environment for CVE-2025-31133, focusing on Docker Compose build vulnerabilities. It includes a PaaS simulator, policy checks, and sample projects to demonstrate the vulnerability without shipping a full exploit chain.
This repository contains a working proof-of-concept exploit for CVE-2025-31133, a container escape vulnerability in runc. The exploit leverages eBPF to manipulate the core_pattern handler, achieving privilege escalation from within a container to the host system.
References (5)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H