runc CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881

[gerasym]

It is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3 but, kops does not support it.

https://github.com/kubernetes/kops/blob/v1.34.0/pkg/assets/assetdata/runc-1.2.yaml
https://github.com/kubernetes/kops/blob/v1.34.0/pkg/assets/assetdata/runc-1.3.yaml

Will it be possible to also patch kops v.1.32.x? Thank you very much in advance.

[staschuk-auvik]

We also encountered this issue. It's possible to specify a version of runc that isn't listed in those files, if you provide the URL and SHA256 hash of the runc executable: see https://kops.sigs.k8s.io/cluster_spec/#runc-version-and-packages . The hashes can be found on the runc releases page, under Assets, e.g.:

(Or, of course, you can download the file and hash it locally.)

[gerasym]

Thanks a lot, i will try it!