Container Escape Vulnerabilities in runc via /dev/console Mount Races

Multiple vulnerabilities were discovered in runc, the container runtime used by Docker, Kubernetes, and other platforms, that allow attackers to escape container isolation. One of the critical flaws, tracked as CVE-2025-52565, arises from insufficient validation during the bind-mounting of /dev/pts/$n to /dev/console inside containers. Attackers can exploit this race condition to redirect the mount and gain write access to protected files in the procfs, such as /proc/sysrq-trigger or /proc/sys/kernel/core_pattern, potentially leading to denial of service or container breakout. The vulnerability affects runc versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, and has been addressed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

Exploitation of CVE-2025-52565 requires the ability to start containers with custom mount configurations, making environments that run untrusted container images or Dockerfiles particularly vulnerable. No active exploits have been reported as of the disclosure, but security researchers recommend updating to the patched runc versions and monitoring for suspicious container activity. The vulnerability is similar in concept to CVE-2025-31133 but targets a different aspect of the container initialization process, specifically the timing and validation of the /dev/console mount before security protections are fully applied.