High · published November 7, 2025
⚡ A sneaky oversight in runc lets attackers mount the wrong thing! If they can trick the container into using a fake /dev/null inode, they might just steal sensitive host info or even escape the container altogether. 🔥 Think of runc as a delivery service that misdelivers packages because it never checks the mailing address — it could drop off a 'nothing' package or even worse, the neighbor's secret stash! The consequences could be absolutely devastating: attackers could gain unauthorized access to sensitive host information, disrupt services, or even escape the containment of a malicious container. This could potentially lead to a full-blown compromise of the host system, putting your entire environment at risk!
Think of runc as a delivery service that misdelivers packages because it never checks the mailing address — it could drop off a 'nothing' package or even worse, the neighbor's secret stash! This vulnerability arises from runc not properly verifying that the bind-mount source is a legitimate /dev/null inode, allowing unauthorized access and manipulation of host resources through an arbitrary mount gadget.
The consequences could be absolutely devastating: attackers could gain unauthorized access to sensitive host information, disrupt services, or even escape the containment of a malicious container. This could potentially lead to a full-blown compromise of the host system, putting your entire environment at risk! To secure your systems, upgrade to runc versions 1.2.8, 1.3.3, or 1.4.0-rc.3 immediately. It's also essential to review your container configurations and ensure that proper verification mechanisms are in place for bind mounts. You've got this! Apply the updates and your containers will be safer than ever. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| linuxfoundation/runc | < 1.2.8 | 1.2.8 |
| linuxfoundation/runc | ≥ 1.3.0, < 1.3.3 | 1.3.3 |
| linuxfoundation/runc | all versions | — |
| linuxfoundation/runc | all versions | — |