The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2025-11079:02 advisory.

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)
      * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)
      * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0327-1 advisory.

    Update to 1.12.2:

    Security fixes:

    - CVE-2025-68156: github.com/expr-lang/expr/builtin: Fixed potential DoS via unbounded recursion     (bsc#1255333):
    - CVE-2025-31133, CVE-2025-52565, CVE-2025-52881: github.com/opencontainers/runc: Fixed container       breakouts by bypassing runc's restrictions for writing to arbitrary /proc files (bsc#1255074)

    Other fixes:

        - Add missing configuration parameter           deployment_name_from_replicaset to k8sattributes processor           (5b90a9d) (@dehaansa)
        - database_observability: Fix schema_details collector to fetch           column definitions with case sensitive table names (#4872)           (560dff4) (@jharvey10, @fridgepoet)
        - deps: Update jose2go to 1.7.0 (#4858) (dfdd341) (@jharvey10)
        - deps: Update npm dependencies [backport] (#5201) (8e06c26)           (@jharvey10)
        - Ensure the squid exporter wrapper properly brackets ipv6           addresses [backport] (#5205) (e329cc6) (@dehaansa)
        - Preserve meta labels in loki.source.podlogs (#5097) (ab4b21e)           (@kalleep)
        - Prevent panic in import.git when update fails [backport]           (#5204) (c82fbae) (@dehaansa, @jharvey10)
        - show correct fallback alloy version instead of v1.13.0           (#5110) (b72be99) (@dehaansa, @jharvey10)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0995 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.61. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2026:1003

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)
    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)
    * runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and     procfs write redirects (CVE-2025-52881)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-     single/updating_clusters/index#updating-cluster-cli.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:1540 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.15.61. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2026:1549

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race     conditions (CVE-2025-31133)
    * runc: container escape with malicious config due to /dev/console mount     and related races (CVE-2025-52565)
    * runc: opencontainers/selinux: container escape and denial of service due     to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    All OpenShift Container Platform 4.15 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift CLI (oc)     or web console. Instructions for upgrading a cluster are available at     https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-     single/updating_clusters/index#updating-cluster-cli.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform     sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a     real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an     arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape,     or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
    (CVE-2025-31133)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3951-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252232).
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252232).
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252232).

    Update to runc v1.2.7.

    - Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.2.7>

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:20957 advisory.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4079-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252376)
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252376)
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252376)

    Other fixes:
    - podman and buildah with runc 1.3.2 fail with lots of warnings as rootless (bsc#1252543)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21328 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.14.59. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2025:21331

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race     conditions (CVE-2025-31133)
    * runc: container escape with malicious config due to /dev/console mount     and related races (CVE-2025-52565)
    * runc: opencontainers/selinux: container escape and denial of service due     to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)
    * net/http: Request smuggling due to acceptance of invalid chunked data in     net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift CLI (oc)     or web console. Instructions for upgrading a cluster are available at     https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-     single/updating_clusters/index#updating-cluster-cli.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    runc is a CLI tool for spawning and running containers according to the OCI specification. Versions     1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient     checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc     into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker     can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it     attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to     `/dev/console` as configured for all containers that allocate a console). This happens after     `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with     CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the     attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
    This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-52565)

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform     sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a     real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an     arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape,     or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and     1.4.0-rc.3.(CVE-2025-31133)

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs     files through the use of a racing container with shared mounts (we have also verified this attack is     possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering     parallel execution of containers with custom shared mounts configured). This redirect could be through     symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the     mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused     runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in     versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22942-1 advisory.

    Update to 1.3.6.

    - CVE-2026-41579: malicious image with a `/dev` symlink can trigger limited host filesystem integrity     violations       (bsc#1268275).

    Other updates and bugfixes:

    - Version 1.3.6:
      * Various integration test improvements.
      * When masking directories with `maskPaths`, runc will now re- use a single `tmpfs` instance (which is     not writeable)         to reduce the number `tmpfs` superblocks that need to be reaped when containers die (in particular,     Kubernetes         applies masks to per-CPU sysfs directories which get expensive quickly).
    - Version 1.3.5:
      * Recursive atime-related mount flags (rrelatime et al.) are now applied properly.
      * PR #4757 caused a regression that resulted in spurious cannot start a container that has stopped     errors when         running runc create and has thus been reverted.
      * Updated builds to Go 1.25, libseccomp v2.6.0.
      * Minor signing keyring updates.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763648873 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform     sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a     real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an     arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape,     or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
    (CVE-2025-31133)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. Versions     1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient     checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc     into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker     can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it     attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to     `/dev/console` as configured for all containers that allocate a console). This happens after     `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with     CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the     attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
    This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3. (CVE-2025-52565)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs     files through the use of a racing container with shared mounts (we have also verified this attack is     possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering     parallel execution of containers with custom shared mounts configured). This redirect could be through     symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the     mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused     runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in     versions 1.2.8, 1.3.3, and 1.4.0-rc.3. (CVE-2025-52881)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the runc package has been released.

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1306 advisory.

    This advisory aggregates security fixes for the aardvark-dns SRPM in CIQ LTS 8.6. It addresses 5 CVEs:
    CVE-2025-52881, CVE-2025-6032, CVE-2025-9566, CVE-2025-31133, CVE-2025-52565.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1307 advisory.

    This advisory aggregates security fixes for the crun SRPM in CIQ LTS 8.6. It addresses 5 CVEs:
    CVE-2025-52881, CVE-2025-6032, CVE-2025-9566, CVE-2025-31133, CVE-2025-52565.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1310 advisory.

    This advisory aggregates security fixes for the buildah SRPM in CIQ LTS 8.6. It addresses 5 CVEs:
    CVE-2025-52881, CVE-2025-6032, CVE-2025-9566, CVE-2025-31133, CVE-2025-52565.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
283378	MiracleLinux 9 : runc-1.2.5-3.el9_6 (AXSA:2025-11079:02)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/2/13	high
297190	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:0327-1)	Nessus	SuSE Local Security Checks	2026/1/30	2026/1/30	high
297288	RHEL 8 / 9 : OpenShift Container Platform 4.14.61 (RHSA-2026:0995)	Nessus	Red Hat Local Security Checks	2026/1/31	2026/1/31	high
298063	RHEL 8 / 9 : OpenShift Container Platform 4.15.61 (RHSA-2026:1540)	Nessus	Red Hat Local Security Checks	2026/2/5	2026/2/5	high
272311	Linux Distros Unpatched Vulnerability : CVE-2025-31133	Nessus	Misc.	2025/11/5	2026/9/2	high
274484	SUSE SLES12 Security Update : runc (SUSE-SU-2025:3951-1)	Nessus	SuSE Local Security Checks	2025/11/7	2025/12/5	high
274764	RHEL 9 : runc (RHSA-2025:20957)	Nessus	Red Hat Local Security Checks	2025/11/11	2025/12/5	high
275278	SUSE SLES15 Security Update : podman (SUSE-SU-2025:4079-1)	Nessus	SuSE Local Security Checks	2025/11/13	2025/11/13	high
276640	RHEL 8 / 9 : OpenShift Container Platform 4.14.59 (RHSA-2025:21328)	Nessus	Red Hat Local Security Checks	2025/11/24	2026/3/6	high
302611	EulerOS 2.0 SP11 : docker-runc (EulerOS-SA-2026-1575)	Nessus	Huawei Local Security Checks	2026/3/16	2026/3/16	high
330547	SUSE SLES16 Security Update : runc (SUSE-SU-2026:22942-1)	Nessus	SuSE Local Security Checks	2026/7/29	2026/7/29	high
351581	AlmaLinux 9.2 [TuxCare] Security Update: runc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763648873)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/10/5	high
299589	Photon OS 4.0: Runc PHSA-2026-4.0-0964	Nessus	PhotonOS Local Security Checks	2026/2/19	2026/11/2	high
353811	Rocky Linux 8.6 [CIQ] Security Update: aardvark-dns Multiple Vulnerabilities (ciqsa-2026_1306)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
353948	Rocky Linux 8.6 [CIQ] Security Update: crun Multiple Vulnerabilities (ciqsa-2026_1307)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
355262	Rocky Linux 8.6 [CIQ] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ciqsa-2026_1310)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high