The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4080-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252376)
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252376)
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252376)

    Other fixes:

    - Fix: podman and buildah with runc 1.3.2 fail with lots of warnings as rootless (bsc#1252543)
    - Add symlink to catatonit in /usr/libexec/podman (bsc#1248988)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:21232 advisory.

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)
      * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)
      * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4073-2 advisory.

    Update to runc v1.3.3. Upstream changelog is available from

      <https://github.com/opencontainers/runc/releases/tag/v1.3.3>. bsc#1252232

      * CVE-2025-31133
      * CVE-2025-52565
      * CVE-2025-52881

    Update to runc v1.3.2. Upstream changelog is available from

    <https://github.com/opencontainers/runc/releases/tag/v1.3.2> bsc#1252110

      - Includes an important fix for the CPUSet translation for cgroupv2.

    Update to runc v1.3.1. Upstream changelog is available from

    <https://github.com/opencontainers/runc/releases/tag/v1.3.1>

    Update to runc v1.3.0. Upstream changelog is available from

    <https://github.com/opencontainers/runc/releases/tag/v1.3.0>

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-20957 advisory.

    - fix CVE-2025-31133 CVE-2025-52565 CVE-2025-52881

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11112:01 advisory.

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)
      * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)
      * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0701 advisory.

  - runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

  - runc: container escape with malicious config due to /dev/console mount and related races (CVE-2025-52565)

  - runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and     procfs write redirects (CVE-2025-52881)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    runc is a CLI tool for spawning and running containers according to the OCI specification. Versions     1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient     checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc     into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker     can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it     attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to     `/dev/console` as configured for all containers that allocate a console). This happens after     `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with     CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the     attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
    This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-52565)

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs     files through the use of a racing container with shared mounts (we have also verified this attack is     possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering     parallel execution of containers with custom shared mounts configured). This redirect could be through     symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the     mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused     runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in     versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform     sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a     real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an     arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape,     or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and     1.4.0-rc.3.(CVE-2025-31133)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform     sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a     real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an     arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape,     or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and     1.4.0-rc.3.(CVE-2025-31133)

    runc is a CLI tool for spawning and running containers according to the OCI specification. Versions     1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient     checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc     into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker     can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it     attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to     `/dev/console` as configured for all containers that allocate a console). This happens after     `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with     CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the     attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
    This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-52565)

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs     files through the use of a racing container with shared mounts (we have also verified this attack is     possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering     parallel execution of containers with custom shared mounts configured). This redirect could be through     symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the     mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused     runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in     versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
275277	SUSE SLES15 Security Update : podman (SUSE-SU-2025:4080-1)	Nessus	SuSE Local Security Checks	2025/11/13	2025/11/13	high
275837	AlmaLinux 8 : container-tools:rhel8 (ALSA-2025:21232)	Nessus	Alma Linux Local Security Checks	2025/11/20	2026/3/12	high
276801	SUSE SLES15 Security Update : runc (SUSE-SU-2025:4073-2)	Nessus	SuSE Local Security Checks	2025/11/25	2026/3/3	high
277330	Oracle Linux 9 : runc (ELSA-2025-20957)	Nessus	Oracle Linux Local Security Checks	2025/12/3	2026/2/27	high
291789	MiracleLinux 8 : container-tools:rhel8 (AXSA:2025-11112:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
311512	RHCOS 4 : OpenShift Container Platform 4.17.47 (RHSA-2026:0701)	Nessus	Red Hat Local Security Checks	2026/5/2	2026/5/2	high
297606	EulerOS 2.0 SP13 : docker-runc (EulerOS-SA-2026-1220)	Nessus	Huawei Local Security Checks	2026/2/2	2026/2/2	high
302444	EulerOS 2.0 SP10 : docker-runc (EulerOS-SA-2026-1332)	Nessus	Huawei Local Security Checks	2026/3/16	2026/3/16	high

检测

插件搜索

high

high

high

high

high

high

high

high