Container Service for Kubernetes:Remediation for runc vulnerabilities CVE-2025-31133,CVE-2025-52565,and CVE-2025-52881

Drain the node

1. Mark the node as unschedulable. Replace <NODE_NAME> with the actual node name.

   kubectl cordon <NODE_NAME>

2. Evict all pods from the node.

   kubectl drain <NODE_NAME> --grace-period=120 --ignore-daemonsets=true

Apply the fix

1. Log in to the target edge node.

2. Set the REGION and INTERCONNECT_MODE environment variables.

   Variable	Description
   REGION	The region ID where your cluster is located. For supported regions, see Supported regions.
   INTERCONNECT_MODE	The node's network connection type: basic (public network) or private (private network).

   export REGION="cn-hangzhou"  INTERCONNECT_MODE="basic"  # Replace with your actual values.

3. Run the remediation script.

   #!/bin/bash
   set -e -x
   
   # --- Parameter validation ---
   if [[ $REGION == "" ]];then
       echo "Error: REGION is null"
       exit 1
   fi
   
   if [[ $INTERCONNECT_MODE == "" ]]; then
      echo "Error: INTERCONNECT_MODE is null"
      exit 1
   fi
   
   # --- Check if upgrade is needed ---
   if containerd --version | grep -q "1.6.39"; then
      echo "No need to upgrade current containerd (1.6.39)"
      exit 0
   fi
   
   export OS_ARCH=amd64
   case $(uname -m) in
   "sw_64")
       export OS_ARCH=sw64
       ;;
   "x86_64")
       export OS_ARCH=amd64
       ;;
   "arm64")
       export OS_ARCH=arm64
       ;;
   "aarch64")
       export OS_ARCH=arm64
       ;;
   *)
       echo "Unknown architecture $(uname -a). Defaulting to amd64."
       ;;
   esac
   
   INTERNAL=$( [ "$INTERCONNECT_MODE" = "private" ] && echo "-internal" || echo "" )
   SERVER="http://aliacs-k8s-${REGION}.oss-${REGION}${INTERNAL}.aliyuncs.com"
   
   if grep -q -E "Ubuntu|Debian" /etc/os-release; then
       export PKG_MGR="-deb"
   else
       export PKG_MGR=""
   fi
   
   CONTAINERD_VERSION="1.6.39"
   CONTAINERD_PACKAGE_URL="$SERVER/public/pkg/containerd${PKG_MGR}/containerd${PKG_MGR}-${CONTAINERD_VERSION}-linux-${OS_ARCH}.tar.gz"
   
   # --- Download and install ---
   wget $CONTAINERD_PACKAGE_URL -O /tmp/containerd.tar.gz
   mkdir -p /tmp/containerd
   tar xf /tmp/containerd.tar.gz -C /tmp/containerd
   
   if [[ $PKG_MGR == "-deb" ]]; then
       apt install -y /tmp/containerd/pkg/containerd-deb/$CONTAINERD_VERSION/deb/*.deb
   else
       yum localinstall -y /tmp/containerd/pkg/containerd/$CONTAINERD_VERSION/rpm/*
   fi
   
   # --- Restart and confirm ---
   systemctl restart containerd
   echo "Successfully upgraded containerd"

4. Check the output to confirm the result.

   • If the node was already running 1.6.39, the script exits with:

     No need to upgrade current containerd (1.6.39)

   • If the upgrade completed successfully:

     Successfully upgraded containerd

Restore the node

Make the node schedulable again. Replace <NODE_NAME> with the actual node name.

kubectl uncordon <NODE_NAME>