Learn-about-cve-2025-31133-poc

CVE-2025-31133-PoC について学ぶ 概要 CVE-2025-31133 の概念実証デモンストレーションと学習環境です。これは runc のセキュリティ脆弱性であり、競合状態を利用して maskedPaths 保護をバイパスするものです。maskedPaths は、コンテナが機密性の高いホストファイルシステムパスにアクセスするのを防ぐために設計されています。 https://github.com/user-attachments/assets/d7b4ea43-6cab-4ac5-bb07-08bc46479910 👉 このリポジトリは、Black Hat...

CVE-2025-31133

CVE-2025-31133 PoC 利用 本文档说明所提供的 runc 漏洞 CVE-2025-31133 的 Proof-of-Concept PoC 脚本的功能。 摘要 漏洞： CVE-2025-31133 - runc 中 maskedPaths 处理的一个符号链接条件竞争漏洞。 影响： 恶意容器可以绕过 maskedPaths 的保护，从而允许写入宿主机上的敏感文件。这构成了一次容器逃逸 。 PoC 目标： 安全地演示漏洞：从容器内部修改宿主机的 /proc/sys/kernel/corepattern 文件。 安全性： 此 PoC 是非破坏性的。它仅向目标文件写入字符串...

CVE-2025-31133

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount i.e., the container's /dev/null was...

CVE-2025-31133

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount i.e., the container's /dev/null was...

Exploit for CVE-2025-31133

CVE-2025-31133 runc maskedPaths Exploit PoC WARNING:...

Race Condition Enabling Link Following

Overview Affected versions of this package are vulnerable to Race Condition Enabling Link Following via a race condition in the maskedPaths feature. An attacker can gain unauthorized access to host files, execute arbitrary code with elevated privileges, or cause a denial of service by manipulatin...

rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc

Impact It was found that rootless runc makes /sys/fs/cgroup writable in following conditons: 1. when runc is executed inside the user namespace, and the config.json does not specify the cgroup namespace to be unshared e.g.., docker|podman|nerdctl run --cgroupns=host, with Rootless...

GHSA-M8CG-XC2P-R3FC rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc

Impact It was found that rootless runc makes /sys/fs/cgroup writable in following conditons: 1. when runc is executed inside the user namespace, and the config.json does not specify the cgroup namespace to be unshared e.g.., docker|podman|nerdctl run --cgroupns=host, with Rootless...

Design/Logic Flaw

runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes /sys/fs/cgroup writable in following conditons: 1. when runc is executed inside the user namespace, and the config.json does not specify the cgroup...

CVE-2023-25809

CVE-2023-25809 affects runc (rootless and certain host configurations) where rootless runc can make /sys/fs/cgroup writable under two conditions: 1) inside a user namespace without unsharing cgroup namespace (e.g., docker/podman/nerdctl run --cgroupns=host), or 2) outside the user namespace with ...

CVE-2023-25809 rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc

runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes /sys/fs/cgroup writable in following conditons: 1. when runc is executed inside the user namespace, and the config.json does not specify the cgroup...

CVE-2023-25809

runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes /sys/fs/cgroup writable in following conditons: 1. when runc is executed inside the user namespace, and the config.json does not specify the cgroup...