This advisory addresses several security vulnerabilities in the runc component of Red Hat OpenShift Container Platform, specifically CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881. The issues involve container escape through 'masked path' abuse due to mount race conditions, escape via malicious container configuration exploiting /dev/console mount races, and container escape and denial of service caused by arbitrary write gadgets and procfs write redirects in opencontainers/selinux. These vulnerabilities affect multiple OpenShift versions including 4.14 and 4.16 branches. Red Hat has released updated RPM packages and container images in OpenShift Container Platform 4.14.61 and 4.16.55 to address these vulnerabilities.

Successful exploitation of these vulnerabilities could allow an attacker to escape from a container to the host system, potentially leading to unauthorized access or denial of service. The vulnerabilities affect container isolation mechanisms, which are critical for multi-tenant security in Kubernetes environments. The severity is rated as high by Red Hat Product Security.

Red Hat has released official security updates in OpenShift Container Platform 4.14.61 and 4.16.55 that fix these vulnerabilities. Users should upgrade to these versions or later as soon as they are available in their release channels. Instructions for upgrading clusters are provided by Red Hat and can be performed via the OpenShift CLI or web console. No alternative mitigations are indicated; applying the official updates is required to remediate these issues.