This advisory covers security updates in Red Hat OpenShift Container Platform 4.12.84 that fix three vulnerabilities (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) in the runc component. The issues include container escape via 'masked path' abuse due to mount race conditions, container escape with malicious config exploiting /dev/console mount races, and container escape and denial of service caused by arbitrary write gadgets and procfs write redirects. Red Hat rates the security impact of these fixes as low. The advisory provides updated RPM packages and container images for affected platforms and instructs users to upgrade accordingly.

The vulnerabilities fixed in this update could allow a container escape, potentially enabling an attacker to break out of container isolation. However, Red Hat Product Security has assessed the overall security impact as low. There are no known exploits in the wild at the time of this advisory. The issues relate specifically to the runc container runtime component and involve race conditions and arbitrary write capabilities that could lead to denial of service or privilege escalation from within a container.

Red Hat has released updated packages in OpenShift Container Platform 4.12.84 that address these vulnerabilities. Users should upgrade to version 4.12.84 using the OpenShift CLI or web console as soon as the update is available in their release channel. Detailed upgrade instructions are provided in Red Hat's official documentation. No additional mitigations are indicated or required beyond applying the official update.