This advisory covers security updates for Red Hat OpenShift Container Platform 4.16.53, which fixes three vulnerabilities in the runc container runtime: CVE-2025-31133 (container escape via 'masked path' abuse due to mount race conditions), CVE-2025-52565 (container escape with malicious config due to /dev/console mount and related races), and CVE-2025-52881 (container escape and denial of service via arbitrary write gadgets and procfs write redirects in opencontainers/selinux). These vulnerabilities could allow an attacker to escape container isolation under certain conditions. The update addresses these issues by providing patched container images and RPM packages. Users running OpenShift Container Platform 4.16 prior to 4.16.53 should upgrade to this release to remediate the vulnerabilities.

The vulnerabilities allow potential container escape, which could lead to unauthorized access to the host system or denial of service. This compromises container isolation, a critical security boundary in Kubernetes environments. The issues specifically involve race conditions and malicious configurations in the runc runtime and related SELinux components. Successful exploitation could impact the confidentiality, integrity, and availability of the affected systems.

An official fix is available in Red Hat OpenShift Container Platform version 4.16.53. Users should upgrade to this version using the OpenShift CLI (oc) or web console as soon as the update is available in their release channel. Detailed upgrade instructions are provided by Red Hat at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli. No additional mitigations are specified beyond applying the update.