container-escape-ebpf

白皮书 https://www.scs-europe.net/dlib/2026/2026-0321.html 假设 主机运行存在漏洞的 runc 版本： 对于 CVE-2025-31133：1.2.7 及以下版本、1.3.0-rc.1 至 1.3.2、1.4.0-rc.1 及 1.4.0-rc.2。 对于 CVE-2024-21626：1.0.0-rc93 至 1.1.11。 非特权用户能够使用 runc（或 containerd 的 ctr）通过 OCI 配置文件及纯 rootfs 创建容器。 用法 you@local:container-escape-ebpf$ make depl...

Learn-about-cve-2025-31133-poc

了解CVE-2025-31133-PoC 概览 针对runc中的安全漏洞CVE-2025-31133 的验证概念演示和学习环境，该漏洞通过竞态条件绕过了maskedPaths保护机制。maskedPaths旨在阻止容器访问敏感的主机文件系统路径。 https://github.com/user-attachments/assets/d7b4ea43-6cab-4ac5-bb07-08bc46479910 👉 本仓库是Black Hat培训中教授的研究思维和技术的实际示例： 如果您觉得这有趣，这只是冰山一角。 攻击性容器安全：突破边界的实战课程 📅 Black Hat USA 2026...

RHCOS 4 : OpenShift Container Platform 4.13.63 (RHSA-2026:0676)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0676 advisory. - runc: container escape via 'masked path' abuse due to mount race conditions CVE-2025-31133 - runc: container escape with malicious...

Important: Red Hat Security Advisory: container-tools:rhel8 security update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Red Hat Product Security h...

EulerOS 2.0 SP10 : docker-runc (EulerOS-SA-2026-1332)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through...

Huawei EulerOS: Security Advisory for docker-runc (EulerOS-SA-2026-1332)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for docker-runc (EulerOS-SA-2026-1306)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2026:20626-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2026:20214-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 8 / 9 : OpenShift Container Platform 4.15.61 (RHSA-2026:1540)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:1540 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

SUSE: Security Advisory (SUSE-SU-2026:20103-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for buildah (important)

openSUSE security update: security update for buildah ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20080-1 Rating: important References: bsc1253096 bsc1253598 bsc1254054 Cross-References: CVE-2025-31133 CVE-2025-47913 CVE-2025-47914 CVE-2025-5256...

SUSE SLES16 Security Update : podman (SUSE-SU-2026:20103-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20103-1 advisory. - CVE-2025-31133,CVE-2025-52565,CVE-2025-52881: container breakouts by bypassing runc's restrictions for writing to arbitrary /pro...

RHEL 8 / 9 : OpenShift Container Platform 4.13.63 (RHSA-2026:0676)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0676 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

alloy-1.12.2-2.1 on GA media (moderate)

alloy-1.12.2-2.1 on GA media Announcement ID: openSUSE-SU-2026:10073-1 Rating: moderate Cross-References: CVE-2025-31133 CVE-2025-68156 CVSS scores: CVE-2025-31133 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-31133 SUSE : 7.3...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.55 packages and security update

Red Hat OpenShift Container Platform release 4.16.55 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

MiracleLinux 9 : runc-1.2.5-3.el9_6 (AXSA:2025-11079:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2025-11079:02 advisory. runc: container escape via 'masked path' abuse due to mount race conditions CVE-2025-31133 runc: container escape with malicious config due to...

Important: Red Hat Security Advisory: runc security update

An update for runc is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

OESA-2025-2820 runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fixes: runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would...

SUSE: Security Advisory (SUSE-SU-2025:21136-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...