Re: Bug#1120140: runc: CVE-2025-31133 CVE-2025-52565 CVE-2025-52881
Control: tag -1 trixie bookworm
Salvatore Bonaccorso <carnil@debian.org> writes:
> Source: runc
> Version: 1.3.2+ds1-1
> Severity: grave
> Tags: security upstream
> Justification: user security hole
> X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
> Control: found -1 1.1.15+ds1-2
>
> Hi,
>
> The following vulnerabilities were published for runc.
>
> CVE-2025-31133[0], CVE-2025-52565[1] and CVE-2025-52881[2].
>
>
> If you fix the vulnerabilities please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
>
> For further information see:
>
> [0] https://security-tracker.debian.org/tracker/CVE-2025-31133
> https://www.cve.org/CVERecord?id=CVE-2025-31133
> [1] https://security-tracker.debian.org/tracker/CVE-2025-52565
> https://www.cve.org/CVERecord?id=CVE-2025-52565
> [2] https://security-tracker.debian.org/tracker/CVE-2025-52881
> https://www.cve.org/CVERecord?id=CVE-2025-52881
>
> Please adjust the affected versions in the BTS as needed.
>
> Regards,
> Salvatore
Hi Salvatore (and everyone else CCed),
I've taken a close look at the backport situation for Trixie (runc
1.1.15+ds1-2) and checked other distributions. The upstream patches
(squashed tarball from https://seclists.org/oss-sec/2025/q4/138
attachment runc-patches-2025-11-05.tar.xz, applying to 1.2.7+) do not
work cleanly on 1.1.15 due to refactors in 1.2 (e.g., openat2, cgroup
v2, securejoin).
Trixie summary:
- ~70-80% of the ~20 patches conflict (e.g., in libcontainer/rootfs_linux.go, nsenter).
- Requires bumping golang-github-cyphar-filepath-securejoin-dev, risking reverse dep breaks.
- Effort: 80-150 hours over weeks for a tested backport.
Other distros (as of 2025-12-03; no 1.1.15 backports found):
Distribution Old version in LTS/old-stable Fix strategy + reference
--------------------------------------------------------------------------------
Ubuntu 22.04 / 24.04 1.0.x / 1.1.12 Upgrade to 1.3.3
https://ubuntu.com/security/notices/USN-7851-1
https://ubuntu.com/security/notices/USN-7851-2
RHEL 8 / 9 1.2.5 Custom backports to 1.2.5
https://access.redhat.com/errata/RHSA-2025:19927
SUSE SLE 15 ~1.1.x Upgrade to 1.2.7
https://www.suse.com/support/update/announcement/2025/suse-su-20253951-1/
Fedora 41 1.1.x Upgrade to 1.3.3
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OROGIHQBV5TR2WUJZV5N4SOGYPXGKM5P/
I lack bandwidth for this (day job + other packages). As far as I can
tell, all the issues are addressed in experimental/unstable/testing with
1.3.3+ds1-2.
Options for Debian:
- Full backport to 1.1.15 (expensive, no distro precedent).
- Bump Trixie to 1.2.8/1.3.3 (i.e., introduce new source "runc-app that produces the `runc` binary", like Ubuntu).
- Declare 1.1.x unsupported in Trixie; recommend podman/crun (which is a re-implementation of runc in C)
Salvatore, Gianfranco, Jochen, Shengjing Zhu: Please do share your
opinions and chime in on the best way forward here.
Thanks,
Reinhard
Reply to: