Database/Container, Kubernetes & orchestration
runc: Insufficient checks when bind-mounting /dev/console allow writes to arbitrary host procfs paths
Impact
Insufficient checks when bind-mounting /dev/console allow writes to arbitrary host procfs paths; container escape
Who can reach it
Any tenant workload / malicious image
What to do
Replace runc on all nodes; drain required to restart containers
Fleet impact
How widespread
Universal - same runc version range
Cost to remediate
node-drain - same as above; the fix ships in runc 1.2.8 / 1.3.3 / 1.4.0-rc.3 and only applies to newly created containers
Why it hits the whole fleet
/dev/console bind-mount race/symlink lets runc mount an unexpected target before LSM/mount protections apply, granting write access to procfs and a breakout
References
Related entries
- runc: AppArmor restriction bypass via mount-target check flawCVE-2019-16884 · runcHigh
- runc: Insufficient verification of masked-path bind mounts (/dev/null replaced by symlink) enables containerCVE-2025-31133 · runcHigh
- runc: Attacker misdirects runc writes to /proc via racing symlinksCVE-2025-52881 · runcHigh
- runc: Volume-mount race gives incorrect access control and privilege escalation to hostCVE-2019-19921 · runcHigh
- runc: Regression of CVE-2019-19921: incorrect access control leading to privilege escalation via volume mountsCVE-2023-27561 · runcHigh
- runc: AppArmor bypass when /proc inside the container is symlinked with a specific mount configCVE-2023-28642 · runcMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.