リモート Redhat Enterprise Linux 9 ホストに、RHSA-2025:20957 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    runCツールは、コンテナのランタイムを提供するOpen Container Format（OCF）の軽量でポータブルな実装です。

    セキュリティ修正プログラム:

    * runcマウントの競合状態による「マスクされたパス」の悪用によるコンテナのエスケープCVE-2025-31133]

    * runc/dev/console マウントおよび関連する競合による、悪意のある構成でのコンテナエスケープCVE-2025-52565

    * runc任意の書き込みガジェットおよび procfs 書き込みリダイレクトによるコンテナエスケープおよびサービス拒否CVE-2025-52881

    影響、CVSS スコア、謝辞、その他の関連情報を含むセキュリティ問題の詳細については、「参照」セクションに記載されている CVE のページを参照してください。

Tenable は、前述の記述ブロックを Red Hat Enterprise Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 ホストには、SUSE-SU-2025:4081-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    - CVE-2025-31133マウントの競合状態による「マスクされたパス」の悪用によるコンテナエスケープを修正しましたbsc#1252376
    - CVE-2025-52565/dev/console マウントおよび関連する競合を原因とする、悪意のある構成によるコンテナエスケープを修正しましたbsc#1252376
    - CVE-2025-52881任意の書き込みガジェットおよび procfs 書き込みリダイレクトによるコンテナエスケープとサービス拒否を修正しましたbsc#1252376

    その他の修正:

    - 修正runc の podman と buildah が 1.3.2 ルートのないものとして多くの警告で失敗しますbsc#1252543

Tenable は、前述の記述ブロックを SUSE セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの SUSE Linux SLES12 ホストには、SUSE-SU-2025:4077-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    runc v1.3.3 に更新してください。Upstream 変更ログは以下の場所から入手できます。

      <https://github.com/opencontainers/runc/releases/tag/v1.3.3> bsc#1252232

      * CVE-2025-31133
      * CVE-2025-52565
      * CVE-2025-52881

    runc v1.3.2 に更新してください。Upstream 変更ログは以下の場所から入手できます。

    <https://github.com/opencontainers/runc/releases/tag/v1.3.2> bsc#1252110

      - cgroupv2 に対する CPUSet 変換に対する重要な修正が含まれます。

    runc v1.3.1 に更新してください。Upstream 変更ログは以下の場所から入手できます。

    <https://github.com/opencontainers/runc/releases/tag/v1.3.1>

    runc v1.3.0 に更新してください。Upstream 変更ログは以下の場所から入手できます。

    <https://github.com/opencontainers/runc/releases/tag/v1.3.0>

Tenable は、前述の記述ブロックを SUSE セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform     sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a     real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an     arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape,     or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
    (CVE-2025-31133)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6a0f63aaab advisory.

    Automatic update for runc-1.3.3-1.fc44.

    ##### **Changelog**

    ```
    * Wed Nov  5 2025 Bradley G Smith <bradley.g.smith@gmail.com> - 2:1.3.3-1
    - Update to release v1.3.3
    - Resolves: rhbz#2411664, rhbz#2411410, rhbz#2411148
    - Resolves: rbhz#2410768, rhbz#2410512, rhbz#2410233
    - Resolves: rhbz#2409818, rhbz#2409561, rhbz#2409284
    - Resolves: rhbz#2408345, rhbz#2408091, rhbz#2407818
    - Security. Fixes CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
    - Upstream new feature

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3951-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252232).
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252232).
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252232).

    Update to runc v1.2.7.

    - Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.2.7>

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-19927 advisory.

    - fix CVE-2025-31133 CVE-2025-52565 CVE-2025-52881

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:19927 advisory.

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)
      * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)
      * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.3.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-077 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21232 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
274764	RHEL 9 : runc (RHSA-2025:20957)	Nessus	Red Hat Local Security Checks	2025/11/11	2025/11/11	high
275274	SUSE SLES15 / openSUSE 15 セキュリティ更新 : podman (SUSE-SU-2025:4081-1)	Nessus	SuSE Local Security Checks	2025/11/13	2025/11/13	high
275293	SUSE SLES12 セキュリティ更新: runc (SUSE-SU-2025:4077-1)	Nessus	SuSE Local Security Checks	2025/11/13	2025/11/13	high
272311	Linux Distros Unpatched Vulnerability : CVE-2025-31133	Nessus	Misc.	2025/11/5	2025/11/13	high
274068	Fedora 44 : runc (2025-6a0f63aaab)	Nessus	Fedora Local Security Checks	2025/11/5	2025/11/5	high
274484	SUSE SLES12 Security Update : runc (SUSE-SU-2025:3951-1)	Nessus	SuSE Local Security Checks	2025/11/7	2025/11/7	high
274585	Oracle Linux 9 : runc (ELSA-2025-19927)	Nessus	Oracle Linux Local Security Checks	2025/11/10	2025/11/10	high
274618	AlmaLinux 9 : runc (ALSA-2025:19927)	Nessus	Alma Linux Local Security Checks	2025/11/10	2025/11/10	high
274639	Amazon Linux 2 : runc, --advisory ALAS2NITRO-ENCLAVES-2025-077 (ALASNITRO-ENCLAVES-2025-077)	Nessus	Amazon Linux Local Security Checks	2025/11/11	2025/11/11	high
275300	RHEL 8 : container-tools:rhel8 (RHSA-2025:21232)	Nessus	Red Hat Local Security Checks	2025/11/13	2025/11/13	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high