From b347285b1d8d5c9e1c07e8b138fbb5a1cd792b0f Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Mon, 8 Jun 2026 11:57:45 +0200 Subject: [PATCH] package/runc: security bump to v1.2.9 Fixes the following security issues (in v1.2.8): - CVE-2025-31133: container escape via "masked path" abuse due to mount race conditions https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2 - CVE-2025-52565: container escape with malicious config due to /dev/console mount and related races https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r - CVE-2025-52881: container escape and denial of service due to arbitrary write gadgets and procfs write redirects https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm There are also numerous bugfixes. See the releases notes: - https://github.com/opencontainers/runc/releases/v1.2.5 - https://github.com/opencontainers/runc/releases/v1.2.6 - https://github.com/opencontainers/runc/releases/v1.2.7 - https://github.com/opencontainers/runc/releases/v1.2.8 - https://github.com/opencontainers/runc/releases/v1.2.9 Signed-off-by: Titouan Christophe Signed-off-by: Thomas Perale --- package/runc/runc.hash | 2 +- package/runc/runc.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/runc/runc.hash b/package/runc/runc.hash index d25d8facfd..33850238f3 100644 --- a/package/runc/runc.hash +++ b/package/runc/runc.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 9785c144c97974b52b6091b7a79168b73681ff574bc8438b44f3f5f8c112f171 runc-1.2.4-go2.tar.gz +sha256 8e298469fc729d37920a7ee45c7cd587a4139149abccca485e08d616b80d2fad runc-1.2.9-go2.tar.gz sha256 552a739c3b25792263f731542238b92f6f8d07e9a488eae27e6c4690038a8243 LICENSE diff --git a/package/runc/runc.mk b/package/runc/runc.mk index 51ac32de26..0daffa1368 100644 --- a/package/runc/runc.mk +++ b/package/runc/runc.mk @@ -4,7 +4,7 @@ # ################################################################################ -RUNC_VERSION = 1.2.4 +RUNC_VERSION = 1.2.9 RUNC_SITE = $(call github,opencontainers,runc,v$(RUNC_VERSION)) RUNC_LICENSE = Apache-2.0, LGPL-2.1 (libseccomp) RUNC_LICENSE_FILES = LICENSE