Bug 34719 - opencontainers-runc new security issues CVE-2025-31133, CVE-2025-52565 and CVE-2025-52881
Summary: opencontainers-runc new security issues CVE-2025-31133, CVE-2025-52565 and CV...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-11-05 14:50 CET by Nicolas Salguero
Modified: 2025-11-09 08:53 CET (History)
5 users (show)

See Also:
Source RPM: opencontainers-runc-1.2.4-2.mga10.src.rpm, opencontainers-runc-1.1.14-1.mga9.src.rpm
CVE: CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
Status comment: Fixed upstream in 1.2.8

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nicolas Salguero 2025-11-05 14:50:31 CET 
Those CVEs were announced here:
https://www.openwall.com/lists/oss-security/2025/11/05/3
Nicolas Salguero 2025-11-05 14:51:50 CET

Source RPM: (none) => opencontainers-runc-1.2.4-2.mga10.src.rpm, opencontainers-runc-1.1.14-1.mga9.src.rpm
CVE: (none) => CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
Whiteboard: (none) => MGA9TOO
Status comment: (none) => Fixed upstream in 1.2.8
Severity: normal => critical
Summary: runc new security issues CVE-2025-31133, CVE-2025-52565 and CVE-2025-52881 => opencontainers-runc new security issues CVE-2025-31133, CVE-2025-52565 and CVE-2025-52881

Comment 1 Lewis Smith 2025-11-05 20:50:22 CET 
Assigning to Bruno because you did the most recent 2 version updates.

Assignee: bugsquad => bruno

Bruno Cornec 2025-11-05 22:49:38 CET

Status: NEW => ASSIGNED

Bruno Cornec 2025-11-05 22:49:55 CET

CC: (none) => bruno

Comment 2 Bruno Cornec 2025-11-06 00:48:48 CET 
1.2.8 pushed to cauldron
Comment 3 Bruno Cornec 2025-11-06 00:58:36 CET 
1.2.8 also pushed to mga9 updates_testing

Assignee: bruno => qa-bugs

Comment 4 katnatek 2025-11-06 23:31:37 CET 
Len Lawrence, upload the advisory

Keywords: (none) => advisory

Comment 5 Len Lawrence 2025-11-07 18:05:38 CET 
mga9, x64
$ rpm -q opencontainers-runc
opencontainers-runc-1.2.8-2.1.mga9

Referring to bug#30421 for testing.

$ rpm -q docker
docker-25.0.7-1.mga9
$ rpm -q docker-containerd
docker-containerd-1.7.27-1.mga9

Behind the scenes:
# systemctl start docker
$ docker run hello-world
Hello from Docker!
....
$ docker ps -a
CONTAINER ID   IMAGE         COMMAND    CREATED         STATUS                     PORTS     NAMES
723a8c4d6cdf   hello-world   "/hello"   3 minutes ago   Exited (0) 3 minutes ago             pedantic_cannon
9a7397137e88   hello-world   "/hello"   2 years ago     Exited (0) 2 years ago               blissful_bhaskara

$ docker run -it ubuntu bash
Unable to find image 'ubuntu:latest' locally
latest: Pulling from library/ubuntu
4b3ffd8ccb52: Pull complete 
Digest: sha256:66460d557b25769b102175144d538d88219c077c678a49af4afca6fbfc1b5252
Status: Downloaded newer image for ubuntu:latest
root@a0c9f92e1494:/# dnf install ruby ruby-devel
bash: dnf: command not found
root@a0c9f92e1494:/# exit
exit
$ docker pull fedora:latest
latest: Pulling from library/fedora
30f8cfaf47ed: Pull complete 
Digest: sha256:aa7befe5cfd1f0e062728c16453cd1c479d4134c7b85eac00172f3025ab0d522
Status: Downloaded newer image for fedora:latest
docker.io/library/fedora:latest
latest: Pulling from library/fedora
30f8cfaf47ed: Pull complete 
Digest: sha256:aa7befe5cfd1f0e062728c16453cd1c479d4134c7b85eac00172f3025ab0d522
Status: Downloaded newer image for fedora:latest
docker.io/library/fedora:latest

ruby-bundled-gems                 x86_64 3.4.5-25.fc42           updates   2.2 MiB
 rubygem-bigdecimal                x86_64 3.1.8-25.fc42           updates 134.7 KiB
 rubygem-bundler                   noarch 2.6.9-25.fc42           updates   1.5 MiB
 rubygem-rdoc                      noarch 6.14.0-25.fc42          updates   1.9 MiB

Transaction Summary:
 Installing:        49 packages

Total size of inbound packages is 11 MiB. Need to download 11 MiB.
After this operation, 41 MiB extra will be used (install 41 MiB, remove 0 B).
Is this ok [y/N]: y
[ 1/49] ruby-0:3.4.5-25.fc42.x86_64     100% | 161.5 KiB/s |  39.4 KiB |  00m00s
[ 2/49] ruby-devel-0:3.4.5-25.fc42.x86_ 100% | 735.0 KiB/s | 323.4 KiB |  00m00s
[ 3/49] rubypick-0:1.1.1-22.fc42.noarch 100% |  35.4 KiB/s |  10.0 KiB |  00m00s
[ 4/49] rubygems-0:3.6.9-25.fc42.noarch 100% | 823.7 KiB/s | 396.2 KiB |  00m00s
[ 5/49] ruby-libs-0:3.4.5-25.fc42.x86_6 100% |   5.0 MiB/s |   4.1 MiB |  00m01s
[...]
Complete!
[root@a991825b2269 /]# exit 
exit

$ docker run -it -h cowsay debian bash
Unable to find image 'debian:latest' locally
latest: Pulling from library/debian
13cc39f8244a: Pull complete 
Digest: sha256:01a723bf5bfb21b9dda0c9a33e0538106e4d02cce8f557e118dd61259553d598
Status: Downloaded newer image for debian:latest
root@cowsay:/# apt-get update
Get:1 http://deb.debian.org/debian trixie InRelease [140 kB]
Get:2 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
Get:3 http://deb.debian.org/debian-security trixie-security InRelease [43.4 kB]
Get:4 http://deb.debian.org/debian trixie/main amd64 Packages [9669 kB]
Get:5 http://deb.debian.org/debian trixie-updates/main amd64 Packages [5412 B]
Get:6 http://deb.debian.org/debian-security trixie-security/main amd64 Packages [69.3 kB]
Fetched 9975 kB in 2s (5485 kB/s)                        
Reading package lists... Done
root@cowsay:/# apt-get install -y cowsay fortune
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Note, selecting 'fortune-mod' instead of 'fortune'
The following additional packages will be installed:
  fortunes-min libgdbm-compat4t64 libgdbm6t64 libperl5.40 librecode3
  libtext-charwidth-perl netbase perl perl-modules-5.40
Suggested packages:
  filters cowsay-off fortunes x11-utils bsdextrautils gdbm-l10n sensible-utils
  perl-doc libterm-readline-gnu-perl | libterm-readline-perl-perl make
  libtap-harness-archive-perl
The following NEW packages will be installed:
  cowsay fortune-mod fortunes-min libgdbm-compat4t64 libgdbm6t64 libperl5.40
  librecode3 libtext-charwidth-perl netbase perl perl-modules-5.40
0 upgraded, 11 newly installed, 0 to remove and 0 not upgraded.
Need to get 8126 kB of archives.
After this operation, 53.4 MB of additional disk space will be used.
Get:1 http://deb.debian.org/debian trixie/main amd64 netbase all 6.5 [12.4 kB]
Get:2 http://deb.debian.org/debian trixie/main amd64 perl-modules-5.40 all 5.40.1-6 [3019 kB]
[...]
Setting up perl (5.40.1-6) ...
Setting up cowsay (3.03+dfsg2-8) ...
Processing triggers for libc-bin (2.41-12) ...
root@cowsay:/#
      <At this point user tried several quotes and used up-arrow to recall>
root@cowsay:/# /usr/games/fortune | /usr/games/cowsay
 ________________________________________
/ It is easy to find fault, if one has   \
| that disposition. There was once a man |
| who, not being able to find any other  |
| fault with his coal, complained that   |
| there were too many prehistoric toads  |
| in it.                                 |
|                                        |
| -- Mark Twain, "Pudd'nhead Wilson's    |
\ Calendar"                              /
 ----------------------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||
root@cowsay:/#exit
exit
$

So, no problems with the new containerd.

CC: (none) => tarazed25

Comment 6 Len Lawrence 2025-11-07 18:46:29 CET 
Addendum to comment 5 :-

$ docker ps -a
CONTAINER ID   IMAGE           COMMAND       CREATED          STATUS                        PORTS     NAMES
38aeeff64378   debian          "bash"        21 minutes ago   Exited (0) 7 minutes ago                cool_swartz
a991825b2269   fedora:latest   "/bin/bash"   27 minutes ago   Exited (0) 21 minutes ago               kind_rhodes
a0c9f92e1494   ubuntu          "bash"        33 minutes ago   Exited (127) 30 minutes ago             sharp_snyder
723a8c4d6cdf   hello-world     "/hello"      38 minutes ago   Exited (0) 38 minutes ago               pedantic_cannon
9a7397137e88   hello-world     "/hello"      2 years ago      Exited (0) 2 years ago                  blissful_bhaskara

$ ls .docker
buildx/
$ cd .docker/buildx
$ ls -a
./  ../  activity/  .buildNodeID  current  defaults/  instances/  .lock  refs/
$ 

The container can be restarted:
$ docker run -it -h cowsay debian bash
root@cowsay:/# apt-get update
Get:1 http://deb.debian.org/debian trixie InRelease [140 kB]
Get:2 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
Get:3 http://deb.debian.org/debian-security trixie-security InRelease [43.4 kB]
Get:4 http://deb.debian.org/debian trixie/main amd64 Packages [9669 kB]
Get:5 http://deb.debian.org/debian trixie-updates/main amd64 Packages [5412 B]
Get:6 http://deb.debian.org/debian-security trixie-security/main amd64 Packages [69.3 kB]
Fetched 9975 kB in 2s (5138 kB/s)                        
Reading package lists... Done
root@cowsay:/# apt-get install -y cowsay fortune
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Note, selecting 'fortune-mod' instead of 'fortune'
The following additional packages will be installed:
[...]
debconf: unable to initialize frontend: Dialog
debconf: (No usable dialog-like program is installed, so the dialog based frontend cannot be used. at /usr/share/perl5/Debconf/FrontEnd/Dialog.pm line 79, <STDIN> line 11.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (Can't locate Term/ReadLine.pm in @INC (you may need to install the Term::ReadLine module) (@INC entries checked: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.40.1 /usr/local/share/perl/5.40.1 /usr/lib/x86_64-linux-gnu/perl5/5.40 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl-base /usr/lib/x86_64-linux-gnu/perl/5.40 /usr/share/perl/5.40 /usr/local/lib/site_perl) at /usr/share/perl5/Debconf/FrontEnd/Readline.pm line 8, <STDIN> line 11.)
debconf: falling back to frontend: Teletype
Selecting previously unselected package netbase.
(Reading database ... 4935 files and directories currently installed.)
Preparing to unpack .../00-netbase_6.5_all.deb ...
Unpacking netbase (6.5) ...
Selecting previously unselected package perl-modules-5.40.
Preparing to unpack .../01-perl-modules-5.40_5.40.1-6_all.deb ...
Unpacking perl-modules-5.40 (5.40.1-6) ...
Selecting previously unselected package libgdbm6t64:amd64.
Preparing to unpack .../02-libgdbm6t64_1.24-2_amd64.deb ...
Unpacking libgdbm6t64:amd64 (1.24-2) ...
Selecting previously unselected package libgdbm-compat4t64:amd64.
Preparing to unpack .../03-libgdbm-compat4t64_1.24-2_amd64.deb ...
Unpacking libgdbm-compat4t64:amd64 (1.24-2) ...
Selecting previously unselected package libperl5.40:amd64.
[...]
Setting up cowsay (3.03+dfsg2-8) ...
Processing triggers for libc-bin (2.41-12) ...
root@cowsay:/#  /usr/games/fortune | /usr/games/cowsay
 ________________________
< Be different: conform. >
 ------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||
root@cowsay:/# exit

That was a bit tricky, shooting in the dark, so there may be a better way to do it but the OK still stands.
Len Lawrence 2025-11-07 19:08:01 CET

Whiteboard: MGA9TOO => MGA9TOO, MGA9-64-OK

Comment 7 Thomas Andrews 2025-11-08 14:36:42 CET 
Changing to a MGA9 bug because of comment 2, and validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs
Version: Cauldron => 9
Whiteboard: MGA9TOO, MGA9-64-OK => MGA9-64-OK

Comment 8 Dan Fandrich 2025-11-09 08:11:29 CET 
I've been running this version on x86_64 for a few days with no issues when running Docker containers.

CC: (none) => dan

Comment 9 Mageia Robot 2025-11-09 08:53:09 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0271.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.