According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    runc is a CLI tool for spawning and running containers according to the OCI specification. Versions     1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient     checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc     into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker     can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it     attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to     `/dev/console` as configured for all containers that allocate a console). This happens after     `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with     CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the     attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
    This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-52565)

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform     sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a     real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an     arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape,     or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and     1.4.0-rc.3.(CVE-2025-31133)

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs     files through the use of a racing container with shared mounts (we have also verified this attack is     possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering     parallel execution of containers with custom shared mounts configured). This redirect could be through     symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the     mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused     runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in     versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0418 advisory.

  - runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

  - runc: container escape with malicious config due to /dev/console mount and related races (CVE-2025-52565)

  - runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and     procfs write redirects (CVE-2025-52881)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21328 advisory.

  - net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

  - runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

  - runc: container escape with malicious config due to /dev/console mount and related races (CVE-2025-52565)

  - runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and     procfs write redirects (CVE-2025-52881)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs     files through the use of a racing container with shared mounts (we have also verified this attack is     possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering     parallel execution of containers with custom shared mounts configured). This redirect could be through     symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the     mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused     runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in     versions 1.2.8, 1.3.3, and 1.4.0-rc.3. (CVE-2025-52881)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8729dce4b8 advisory.

    Security update to pack 0.40.8

    Fixes CVE-2024-25621: containerd - local privilege escalation     Fixes CVE-2025-47913: golang.org/x/crypto/ssh/agent - SSH client panic     Fixes CVE-2025-47914: golang.org/x/crypto/ssh/agent - SSH Agent server DoS     Fixes CVE-2025-52881: container escape and denial of service     Fixes CVE-2026-27145: crypto/x509 - DoS via excessive DNS SAN processing     Fixes CVE-2026-33762: go-git - DoS via crafted Git index file     Fixes CVE-2026-34165: go-git - DoS via crafted .idx file     Fixes CVE-2026-39828: golang.org/x/crypto/ssh - Unauthorized command execution     Fixes CVE-2026-39829: golang.org/x/crypto/ssh - DoS via crafted public key     Fixes CVE-2026-39830: golang.org/x/crypto/ssh - Resource leak DoS     Fixes CVE-2026-39832: golang.org/x/crypto/ssh/agent - Key restrictions bypass     Fixes CVE-2026-39833: golang.org/x/crypto/ssh/agent - Key confirmation bypass     Fixes CVE-2026-39835: golang.org/x/crypto/ssh - Certificate DoS     Fixes CVE-2026-44740: go-billy - DoS via symlink cycle     Fixes GO-2026-4970: Root escape via symlink plus trailing slash     Fixes GO-2026-5856: Encrypted Client Hello privacy leak

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
302611	EulerOS 2.0 SP11 : docker-runc (EulerOS-SA-2026-1575)	Nessus	Huawei Local Security Checks	2026/3/16	2026/3/16	high
311538	RHCOS 4 : OpenShift Container Platform 4.16.55 (RHSA-2026:0418)	Nessus	Red Hat Local Security Checks	2026/5/2	2026/5/2	high
311901	RHCOS 4 : OpenShift Container Platform 4.14.59 (RHSA-2025:21328)	Nessus	Red Hat Local Security Checks	2026/5/4	2026/5/4	high
272309	Linux Distros Unpatched Vulnerability : CVE-2025-52881	Nessus	Misc.	2025/11/5	2026/7/21	high
331315	Fedora 44 : pack (2026-8729dce4b8)	Nessus	Fedora Local Security Checks	2026/7/30	2026/7/30	high

检测

插件搜索

high

high

high

high

high