The container-tools module in Red Hat Enterprise Linux 8 includes tools such as podman, buildah, skopeo, and runc. Three distinct vulnerabilities in runc have been fixed: CVE-2025-31133 involves container escape through 'masked path' abuse exploiting mount race conditions; CVE-2025-52565 involves container escape using malicious configuration related to /dev/console mounts and race conditions; CVE-2025-52881 involves container escape and denial of service through arbitrary write gadgets and procfs write redirects. These vulnerabilities allow a container to potentially escape its isolation boundary, leading to elevated privileges or denial of service conditions. Red Hat has released updated packages to remediate these issues as part of the container-tools:rhel8 module update.

Successful exploitation of these vulnerabilities could allow an attacker to escape container isolation, potentially gaining unauthorized access to the host system or causing denial of service. This compromises the security boundary containers provide, increasing risk of privilege escalation and system disruption on affected Red Hat Enterprise Linux 8 systems.

Red Hat has released an important security update for the container-tools:rhel8 module that addresses these vulnerabilities. Users should apply the update as soon as possible following the guidance in the Red Hat advisory RHSA-2025:21232 (https://access.redhat.com/errata/RHSA-2025:21232). This update includes fixes for all three CVEs affecting runc. No additional mitigation steps are indicated beyond applying the official update.