CVE-2025-52565: GO-2025-4096 - Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc

CVE-2025-52565 · Severity: high · CVSS 7.8 · Published 2025-11-06

Multiple security vulnerabilities have been identified in runc, a core component used by many container platforms to launch and manage containers. If exploited, these flaws could allow a malicious container to potentially escape its isolation or gain unauthorized access to the underlying host system. While AWS has stated there is no risk of one customer accessing another's data, organizations using these tools to isolate their own internal workloads should apply updates to prevent internal security breaches.

Technologies: Amazon AWS, github.com/opencontainers/runc (Go), Open Container Initiative Runc. Vendors: Amazon, AWS, Go, Open Container Initiative.

Quick answers

Is CVE-2025-52565 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-52565 being exploited in the wild.
How severe is CVE-2025-52565?
High severity, with a CVSS score of 7.8, published 6 November 2025.
Which products and versions are affected?
github.com/opencontainers/runc (Go) SEMVER:introduced=0,fixed=1.2.8, SEMVER:introduced=0,fixed=1.2.8,introduced=1.3.0-rc.1,fixed=1.3.3,introduced=1.4.0-rc.1,fixed=1.4.0-rc.3; Open Container Initiative Runc < 1.3.2-2.
Is there a fix for CVE-2025-52565?
Yes. github.com/opencontainers/runc (Go): upgrade to 1.2.8, 1.4.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-52565 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2025-52565?
Check whether you run Amazon AWS, AWS Amazon Linux 2, AWS Amazon Linux 2023 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/opencontainers/runc (Go): upgrade to 1.2.8, 1.4.0-rc.3 or later
    go get github.com/opencontainers/runc@v1.4.0-rc.3

Technical details

Three vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) affect the runc component used across various container management systems. The issues occur during the container launch process and can potentially be exploited by a malicious container image or process to break out of the containerized environment or escalate privileges on the host. The attack vector is local, requiring the ability to run a container on the target system. AWS has released patched versions of Amazon Linux, Bottlerocket, and updated AMIs for ECS and EKS. Users of self-managed container environments are advised to update runc to version 1.3.2-2 or later.

Affected products

  • Open Container Initiative (OCI) runc < 1.3.2-2
  • AWS Amazon Linux 2 / 2023
  • AWS Bottlerocket
  • AWS Amazon ECS / EKS
  • AWS Finch

Identifiers

  • CVE-2025-52565
  • CVE-2025-31133
  • CVE-2025-52881
  • GHSA-9493-h29p-rfm2
  • GO-2025-4096

Timeline

  • 2025-11-05: disclosed
  • 2025-11-05: patched: AWS began rolling out patches across affected services

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.