DLPX-95924 [Backport of DLPX-95843] Ubuntu Security Notification for runC Vulnerabilities (USN-7851-1)

[prakashsurya]

Problem

The runc package version currently on release is 1.3.0, and subject to a security vulnerability.

See also: https://nvd.nist.gov/vuln/detail/CVE-2025-31133

Solution

The solution taken in this PR is to use the runc package from "develop" which has a fix for this vulnerability.

Testing Done

• git-ab-pre-push -b misc-debs is here

• Manually installed new runc package on release based engine.. e.g.

$ dpkg -l | grep runc
ii  runc                                                       1.3.0-0ubuntu2~24.04.1                           amd64        Open Container Project - runtime

$ sudo apt-get install ./runc_1.3.3-0ubuntu1~24.04.2_amd64.deb
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Note, selecting 'runc' instead of './runc_1.3.3-0ubuntu1~24.04.2_amd64.deb'
The following packages will be upgraded:
  runc
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/8,815 kB of archives.
After this operation, 315 kB of additional disk space will be used.
Get:1 /export/home/delphix/runc_1.3.3-0ubuntu1~24.04.2_amd64.deb runc amd64 1.3.3-0ubuntu1~24.04.2 [8,815 kB]
debconf: delaying package configuration, since apt-utils is not installed
(Reading database ... 210648 files and directories currently installed.)
Preparing to unpack .../runc_1.3.3-0ubuntu1~24.04.2_amd64.deb ...
Unpacking runc (1.3.3-0ubuntu1~24.04.2) over (1.3.0-0ubuntu2~24.04.1) ...
Setting up runc (1.3.3-0ubuntu1~24.04.2) ...
Processing triggers for man-db (2.12.0-4build2) ...

$ dpkg -l | grep runc
ii  runc                                                       1.3.3-0ubuntu1~24.04.2                           amd64        Open Container Project - runtime

$ get-appliance-version
2025.6.0.0