From da1c00a6f1f512d86bf983a8aa11e3b74516fb68 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Tue, 2 Jun 2026 23:07:55 +0200 Subject: [PATCH] package/runc: security bump to version 1.3.5 Fixes the following security issues (1.3.3): - CVE-2025-31133: container escape via "masked path" abuse due to mount race conditions https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2 - CVE-2025-52565: container escape with malicious config due to /dev/console mount and related races https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r - CVE-2025-52881: container escape and denial of service due to arbitrary write gadgets and procfs write redirects https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm In addition, 1.3.4 and 1.3.5 fixes a number of regressions. For details, see the release notes: https://github.com/opencontainers/runc/releases/tag/v1.3.1 https://github.com/opencontainers/runc/releases/tag/v1.3.2 https://github.com/opencontainers/runc/releases/tag/v1.3.3 https://github.com/opencontainers/runc/releases/tag/v1.3.4 https://github.com/opencontainers/runc/releases/tag/v1.3.5 Signed-off-by: Peter Korsgaard Reviewed-by: Christian Stewart Signed-off-by: Peter Korsgaard (cherry picked from commit e013e2df84fb36985261d7b3c6e6af06afd40f93) Signed-off-by: Thomas Perale --- package/runc/runc.hash | 2 +- package/runc/runc.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/runc/runc.hash b/package/runc/runc.hash index 76857afb31..d3132b1008 100644 --- a/package/runc/runc.hash +++ b/package/runc/runc.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 3262492ce42bea0919ee1a2d000b6f303fd14877295bc38d094876b55fdd448b runc-1.3.0-go2.tar.gz +sha256 72620f9b0e62d8da80c0c08a6265ab10d24330c544115c30713ba1429bde706d runc-1.3.5-go2.tar.gz sha256 552a739c3b25792263f731542238b92f6f8d07e9a488eae27e6c4690038a8243 LICENSE diff --git a/package/runc/runc.mk b/package/runc/runc.mk index bdff619751..10ff98c9d7 100644 --- a/package/runc/runc.mk +++ b/package/runc/runc.mk @@ -4,7 +4,7 @@ # ################################################################################ -RUNC_VERSION = 1.3.0 +RUNC_VERSION = 1.3.5 RUNC_SITE = $(call github,opencontainers,runc,v$(RUNC_VERSION)) RUNC_LICENSE = Apache-2.0, LGPL-2.1 (libseccomp) RUNC_LICENSE_FILES = LICENSE