{"uuid": "a23cebbb-ae27-4ea0-aa11-75df1026cdb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-31133", "type": "seen", "source": "https://t.me/hacking_Attack/182526", "content": "Abusing maskedPaths in runc for container escape (CVE-2025-31133)\nhttps://www.reddit.com/r/redteamsec/comments/1s6qze8/abusing_maskedpaths_in_runc_for_container_escape/\n\nWhile looking into CVE-2025-31133, I came across an interesting primitive in how runc handles maskedPaths. Core Idea\n runc uses maskedPaths to hide sensitive host paths by bind-mounting /dev/null over them inside the container.\n Due to a race condition, an attacker can replace /dev/null with a symlink at the right moment.\n Instead of bind-mounting /dev/null, runc may end up bind-mounting the symlink target with read/write permissions.  This opens the door to interacting with sensitive paths that were supposed to be masked. For example:\n Pointing the symlink to /proc/sys/kernel/core_pattern can lead to a container escape primitive. PoC + Lab\n I put together a small lab to demonstrate this: https://github.com/C-h4ck-0/Learn-about-cve-2025-31133-poc Includes:  Lab setup (Ubuntu)  Working exploit (container escape + reverse shell)   Would be interested to hear if others explored similar primitives or alternative abuse paths.    submitted by    /u/GloomyStreet7164  (https://www.reddit.com/user/GloomyStreet7164) \n [link] (https://github.com/user-attachments/assets/d7b4ea43-6cab-4ac5-bb07-08bc46479910)   [comments] (https://www.reddit.com/r/redteamsec/comments/1s6qze8/abusing_maskedpaths_in_runc_for_container_escape/)", "creation_timestamp": "2026-09-02T01:00:28.236409Z"}