Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.rc > #403929 > unrolled thread

Bug#1120140: runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881

Started bySalvatore Bonaccorso <carnil@debian.org>
First post2025-11-05 22:40 +0100
Last post2025-12-03 13:00 +0100
Articles 5 — 3 participants

Back to article view | Back to linux.debian.bugs.rc

Contents

  Bug#1120140: runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881 Salvatore Bonaccorso <carnil@debian.org> - 2025-11-05 22:40 +0100
    Bug#1120140: marked as done (runc: CVE-2025-31133 CVE-2025-52565  CVE-2025-52881) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-11-16 12:30 +0100
    Bug#1120140: marked as done (runc: CVE-2025-31133 CVE-2025-52565  CVE-2025-52881) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-11-17 17:10 +0100
    Bug#1120140: runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881 Reinhard Tartler <siretart@tauware.de> - 2025-12-03 13:00 +0100
    Processed: Re: Bug#1120140: runc: CVE-2025-31133 CVE-2025-52565  CVE-2025-52881 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-12-03 13:00 +0100

#403929 — Bug#1120140: runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881

FromSalvatore Bonaccorso <carnil@debian.org>
Date2025-11-05 22:40 +0100
SubjectBug#1120140: runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881
Message-ID<LNTow-aLon-11@gated-at.bofh.it>
Source: runc
Version: 1.3.2+ds1-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1.1.15+ds1-2

Hi,

The following vulnerabilities were published for runc.

CVE-2025-31133[0], CVE-2025-52565[1] and CVE-2025-52881[2].


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-31133
    https://www.cve.org/CVERecord?id=CVE-2025-31133
[1] https://security-tracker.debian.org/tracker/CVE-2025-52565
    https://www.cve.org/CVERecord?id=CVE-2025-52565
[2] https://security-tracker.debian.org/tracker/CVE-2025-52881
    https://www.cve.org/CVERecord?id=CVE-2025-52881

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

[toc] | [next] | [standalone]

#404698 — Bug#1120140: marked as done (runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881)

From"Debian Bug Tracking System" <owner@bugs.debian.org>
Date2025-11-16 12:30 +0100
SubjectBug#1120140: marked as done (runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881)
Message-ID<LRJ7b-dnWY-5@gated-at.bofh.it>
In reply to#403929

[Multipart message — attachments visible in raw view] — view raw

Your message dated Sun, 16 Nov 2025 11:20:28 +0000
with message-id <E1vKao0-004ND7-02@fasolo.debian.org>
and subject line Bug#1120140: fixed in runc 1.3.3+ds1-1
has caused the Debian Bug report #1120140,
regarding runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1120140: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1120140
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#404741 — Bug#1120140: marked as done (runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881)

From"Debian Bug Tracking System" <owner@bugs.debian.org>
Date2025-11-17 17:10 +0100
SubjectBug#1120140: marked as done (runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881)
Message-ID<LS9XI-dFBC-13@gated-at.bofh.it>
In reply to#403929

[Multipart message — attachments visible in raw view] — view raw

Your message dated Mon, 17 Nov 2025 15:59:11 +0000
with message-id <E1vL1dH-000Avt-1i@fasolo.debian.org>
and subject line Bug#1120140: fixed in runc 1.3.3+ds1-2
has caused the Debian Bug report #1120140,
regarding runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1120140: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1120140
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#405746

FromReinhard Tartler <siretart@tauware.de>
Date2025-12-03 13:00 +0100
Message-ID<LXTGx-3Dz-1@gated-at.bofh.it>
In reply to#403929
Control: tag -1 trixie bookworm

Salvatore Bonaccorso <carnil@debian.org> writes:

> Source: runc
> Version: 1.3.2+ds1-1
> Severity: grave
> Tags: security upstream
> Justification: user security hole
> X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> Control: found -1 1.1.15+ds1-2
>
> Hi,
>
> The following vulnerabilities were published for runc.
>
> CVE-2025-31133[0], CVE-2025-52565[1] and CVE-2025-52881[2].
>
>
> If you fix the vulnerabilities please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
>
> For further information see:
>
> [0] https://security-tracker.debian.org/tracker/CVE-2025-31133
>     https://www.cve.org/CVERecord?id=CVE-2025-31133
> [1] https://security-tracker.debian.org/tracker/CVE-2025-52565
>     https://www.cve.org/CVERecord?id=CVE-2025-52565
> [2] https://security-tracker.debian.org/tracker/CVE-2025-52881
>     https://www.cve.org/CVERecord?id=CVE-2025-52881
>
> Please adjust the affected versions in the BTS as needed.
>
> Regards,
> Salvatore


Hi Salvatore (and everyone else CCed),

I've taken a close look at the backport situation for Trixie (runc
1.1.15+ds1-2) and checked other distributions. The upstream patches
(squashed tarball from https://seclists.org/oss-sec/2025/q4/138
attachment runc-patches-2025-11-05.tar.xz, applying to 1.2.7+) do not
work cleanly on 1.1.15 due to refactors in 1.2 (e.g., openat2, cgroup
v2, securejoin).

Trixie summary:

- ~70-80% of the ~20 patches conflict (e.g., in libcontainer/rootfs_linux.go, nsenter).
- Requires bumping golang-github-cyphar-filepath-securejoin-dev, risking reverse dep breaks.
- Effort: 80-150 hours over weeks for a tested backport.

Other distros (as of 2025-12-03; no 1.1.15 backports found):

Distribution           Old version in LTS/old-stable   Fix strategy + reference
--------------------------------------------------------------------------------
Ubuntu 22.04 / 24.04   1.0.x / 1.1.12                  Upgrade to 1.3.3
                       https://ubuntu.com/security/notices/USN-7851-1
                       https://ubuntu.com/security/notices/USN-7851-2

RHEL 8 / 9             1.2.5                           Custom backports to 1.2.5
                       https://access.redhat.com/errata/RHSA-2025:19927

SUSE SLE 15            ~1.1.x                          Upgrade to 1.2.7
                       https://www.suse.com/support/update/announcement/2025/suse-su-20253951-1/


Fedora 41              1.1.x                           Upgrade to 1.3.3
                       https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OROGIHQBV5TR2WUJZV5N4SOGYPXGKM5P/

I lack bandwidth for this (day job + other packages). As far as I can
tell, all the issues are addressed in experimental/unstable/testing with
1.3.3+ds1-2.

Options for Debian:

- Full backport to 1.1.15 (expensive, no distro precedent).
- Bump Trixie to 1.2.8/1.3.3 (i.e., introduce new source "runc-app that produces the `runc` binary", like Ubuntu).
- Declare 1.1.x unsupported in Trixie; recommend podman/crun (which is a re-implementation of runc in C)

Salvatore, Gianfranco, Jochen, Shengjing Zhu: Please do share your
opinions and chime in on the best way forward here.

Thanks,
Reinhard

[toc] | [prev] | [next] | [standalone]

#405748 — Processed: Re: Bug#1120140: runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881

From"Debian Bug Tracking System" <owner@bugs.debian.org>
Date2025-12-03 13:00 +0100
SubjectProcessed: Re: Bug#1120140: runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881
Message-ID<LXTGx-3Dz-7@gated-at.bofh.it>
In reply to#403929
Processing control commands:

> tag -1 trixie bookworm
Bug #1120140 {Done: Reinhard Tartler <siretart@tauware.de>} [src:runc] runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881
Added tag(s) bookworm and trixie.

-- 
1120140: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1120140
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.rc

csiph-web