[PR #2864] build(deps): bump github.com/opencontainers/runc from 1.3.2 to 1.3.3 #2905

New Issue

adam · 2025-12-29T04:19:36+01:00

adam commented

2025-12-29 04:19:36 +01:00

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/2864
Author: @dependabot[bot]
Created: 11/5/2025
Status: 🔄 Open

Base: main ← Head: dependabot/go_modules/github.com/opencontainers/runc-1.3.3

📝 Commits (1)

baa4557 build(deps): bump github.com/opencontainers/runc from 1.3.2 to 1.3.3

📊 Changes

2 files changed (+3 additions, -9 deletions)

View changed files

📝 go.mod (+1 -1)
📝 go.sum (+2 -8)

📄 Description

Bumps github.com/opencontainers/runc from 1.3.2 to 1.3.3.

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc v1.3.3 -- "奴らに支配されていた恐怖を"

[!NOTE] Some vendors were given a pre-release version of this release. This public release includes two extra patches to fix regressions discovered very late during the embargo period and were thus not included in the pre-release versions. Please update to this version.

This release contains fixes for three high-severity security vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881). All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files.

Security

CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.

CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount (to /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount the symlink target over /dev/console. This issue affected all versions of runc >= 1.0.0-rc3.

CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.

Added

runc update now supports configuring per-device weights and iops. (#4775, #4807, #4825, #4931)

Static Linking Notices

The runc binary distributed with this release are statically linked with the following [GNU LGPL-2.1][lgpl-2.1] licensed libraries, with runc acting

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.3.3] - 2025-11-05

奴らに支配されていた恐怖を

Security

This release includes fixes for the following high-severity security issues:

CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.

CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount (to /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount the symlink target over /dev/console. This issue affected all versions of runc >= 1.0.0-rc3.

CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.

Added

runc update now supports configuring per-device weights and iops. (#4775, #4807, #4825, #4931)

Commits

d842d77 VERSION: release v1.3.3
b370baf merge private security patches into ghsa-release-1.3.3
4edba17 rootfs: re-allow dangling symlinks in mount targets
aca52c4 openat2: improve resilience on busy systems
8b7e3d7 merge #4931 into opencontainers/runc:release-1.3
2e82e55 tests: bfq: skip tests on misbehaving udev systems
f1627a7 tests: clean up loopback devices properly
178e03c tests/int/update: fix getting block major
f14cad5 runc update: handle duplicated devs properly
80da60e runc update: support per-device weight and iops
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/2864 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 11/5/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `dependabot/go_modules/github.com/opencontainers/runc-1.3.3` --- ### 📝 Commits (1) - [`baa4557`](https://github.com/juanfont/headscale/commit/baa45573a64a7338a74868da84a540cdff9bc36c) build(deps): bump github.com/opencontainers/runc from 1.3.2 to 1.3.3 ### 📊 Changes **2 files changed** (+3 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `go.mod` (+1 -1) 📝 `go.sum` (+2 -8) </details> ### 📄 Description Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.3.2 to 1.3.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/opencontainers/runc/releases">github.com/opencontainers/runc's releases</a>.</em></p> <blockquote> <h2>runc v1.3.3 -- "奴らに支配されていた恐怖を"</h2> <blockquote> <p>[!NOTE] Some vendors were given a pre-release version of this release. This public release includes two extra patches to fix regressions discovered very late during the embargo period and were thus not included in the pre-release versions. Please update to this version.</p> </blockquote> <p>This release contains fixes for three high-severity security vulnerabilities in runc (<a href="https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2">CVE-2025-31133</a>, <a href="https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r">CVE-2025-52565</a>, and <a href="https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm">CVE-2025-52881</a>). All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary <code>/proc</code> files.</p> <h3>Security</h3> <ul> <li> <p><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2">CVE-2025-31133</a> exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's <code>/dev/null</code> inode on top of the file. However, if an attacker can replace <code>/dev/null</code> with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.</p> </li> <li> <p><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r">CVE-2025-52565</a> is very similar in concept and application to <a href="https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2">CVE-2025-31133</a>, except that it exploits a flaw in <code>/dev/console</code> bind-mounts. When creating the <code>/dev/console</code> bind-mount (to <code>/dev/pts/$n</code>), if an attacker replaces <code>/dev/pts/$n</code> with a symlink then runc will bind-mount the symlink target over <code>/dev/console</code>. This issue affected all versions of runc >= 1.0.0-rc3.</p> </li> <li> <p><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm">CVE-2025-52881</a> is a more sophisticated variant of <a href="https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw">CVE-2019-19921</a>, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for <a href="https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw">CVE-2019-19921</a> was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.</p> </li> </ul> <h3>Added</h3> <ul> <li><code>runc update</code> now supports configuring per-device weights and iops. (<a href="https://redirect.github.com/opencontainers/runc/issues/4775">#4775</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4807">#4807</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4825">#4825</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4931">#4931</a>)</li> </ul> <h3>Static Linking Notices</h3> <p>The <code>runc</code> binary distributed with this release are <em>statically linked</em> with the following [GNU LGPL-2.1][lgpl-2.1] licensed libraries, with <code>runc</code> acting</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/opencontainers/runc/blob/v1.3.3/CHANGELOG.md">github.com/opencontainers/runc's changelog</a>.</em></p> <blockquote> <h2>[1.3.3] - 2025-11-05</h2> <blockquote> <p>奴らに支配されていた恐怖を</p> </blockquote> <h3>Security</h3> <p>This release includes fixes for the following high-severity security issues:</p> <ul> <li> <p><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2">CVE-2025-31133</a> exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's <code>/dev/null</code> inode on top of the file. However, if an attacker can replace <code>/dev/null</code> with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.</p> </li> <li> <p><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r">CVE-2025-52565</a> is very similar in concept and application to <a href="https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2">CVE-2025-31133</a>, except that it exploits a flaw in <code>/dev/console</code> bind-mounts. When creating the <code>/dev/console</code> bind-mount (to <code>/dev/pts/$n</code>), if an attacker replaces <code>/dev/pts/$n</code> with a symlink then runc will bind-mount the symlink target over <code>/dev/console</code>. This issue affected all versions of runc >= 1.0.0-rc3.</p> </li> <li> <p><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm">CVE-2025-52881</a> is a more sophisticated variant of <a href="https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw">CVE-2019-19921</a>, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for <a href="https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw">CVE-2019-19921</a> was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.</p> </li> </ul> <h3>Added</h3> <ul> <li><code>runc update</code> now supports configuring per-device weights and iops. (<a href="https://redirect.github.com/opencontainers/runc/issues/4775">#4775</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4807">#4807</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4825">#4825</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4931">#4931</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/opencontainers/runc/commit/d842d7719497cc3b774fd71620278ac9e17710e0"><code>d842d77</code></a> VERSION: release v1.3.3</li> <li><a href="https://github.com/opencontainers/runc/commit/b370bafce960800b7ed758fac29ee4909814316c"><code>b370baf</code></a> merge private security patches into ghsa-release-1.3.3</li> <li><a href="https://github.com/opencontainers/runc/commit/4edba1761914c6de883a1556cd0f92d16e383dac"><code>4edba17</code></a> rootfs: re-allow dangling symlinks in mount targets</li> <li><a href="https://github.com/opencontainers/runc/commit/aca52c4690c188046f5dcb071bb48474a9114b50"><code>aca52c4</code></a> openat2: improve resilience on busy systems</li> <li><a href="https://github.com/opencontainers/runc/commit/8b7e3d7fe28f1fe8387862901abe24888a2f5dd4"><code>8b7e3d7</code></a> merge <a href="https://redirect.github.com/opencontainers/runc/issues/4931">#4931</a> into opencontainers/runc:release-1.3</li> <li><a href="https://github.com/opencontainers/runc/commit/2e82e55edb31ecf3719a538f576af56c1e309d0c"><code>2e82e55</code></a> tests: bfq: skip tests on misbehaving udev systems</li> <li><a href="https://github.com/opencontainers/runc/commit/f1627a7ab75adc56c73fe7e7e2aa60907b9da2c2"><code>f1627a7</code></a> tests: clean up loopback devices properly</li> <li><a href="https://github.com/opencontainers/runc/commit/178e03c7f3fc759dd2b27cd6ad0f33b70662f7f3"><code>178e03c</code></a> tests/int/update: fix getting block major</li> <li><a href="https://github.com/opencontainers/runc/commit/f14cad5a432298aa1533d2b2f8126606449639f7"><code>f14cad5</code></a> runc update: handle duplicated devs properly</li> <li><a href="https://github.com/opencontainers/runc/commit/80da60e12d12e7c4b40cf80fbdd5260fa0c12785"><code>80da60e</code></a> runc update: support per-device weight and iops</li> <li>Additional commits viewable in <a href="https://github.com/opencontainers/runc/compare/v1.3.2...v1.3.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/opencontainers/runc&package-manager=go_modules&previous-version=1.3.2&new-version=1.3.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/juanfont/headscale/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

adam added the pull-request label 2025-12-29 04:19:36 +01:00

Sign in to join this conversation.

Branches Tags

main

update_flake_lock_action

gh-pages

kradalby/release-v0.27.2

dependabot/go_modules/golang.org/x/crypto-0.45.0

dependabot/go_modules/github.com/opencontainers/runc-1.3.3

copilot/investigate-headscale-issue-2788

copilot/investigate-visibility-issue-2788

copilot/investigate-issue-2833

copilot/debug-issue-2846

copilot/fix-issue-2847

dependabot/go_modules/github.com/go-viper/mapstructure/v2-2.4.0

dependabot/go_modules/github.com/docker/docker-28.3.3incompatible

kradalby/cli-experiement3

doc/0.26.1

doc/0.25.1

doc/0.25.0

doc/0.24.3

doc/0.24.2

doc/0.24.1

doc/0.24.0

kradalby/build-docker-on-pr

topic/docu-versioning

topic/docker-kos

juanfont/fix-crash-node-id

juanfont/better-disclaimer

update-contributors

topic/prettier

revert-1893-add-test-stage-to-docs

add-test-stage-to-docs

remove-node-check-interval

fix-empty-prefix

fix-ephemeral-reusable

bug_report-debuginfo

autogroups

logs-to-stderr

revert-1414-topic/fix_unix_socket

rename-machine-node

port-embedded-derp-tests-v2

port-derp-tests

duplicate-word-linter

update-tailscale-1.36

warn-against-apache

ko-fi-link

more-acl-tests

fix-typo-standalone

parallel-nolint

tparallel-fix

rerouting

ssh-changelog-docs

oidc-cleanup

web-auth-flow-tests

kradalby-gh-runner

fix-proto-lint

remove-funding-links

go-1.19

enable-1.30-in-tests

0.16.x

cosmetic-changes-integration

tmp-fix-integration-docker

fix-integration-docker

configurable-update-interval

show-nodes-online

hs2021

acl-syntax-fixes

ts2021-implementation

fix-spurious-updates

unstable-integration-tests

mandatory-stun

embedded-derp

prtemplate-fix

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/headscale#2905