opencontainers · runc
The flaw is an internal file descriptor leak in runc, the Linux CLI tool for spawning and running OCI containers, affecting version 1.1.11 and earlier. An attacker who can get a container process started with the leaked descriptor (via runc exec, or through a malicious image run with runc run) can obtain a working directory in the host filesystem namespace, allowing a container escape and access to the host filesystem, with variants able to overwrite host binaries for a complete escape; exploitation requires local access and some user interaction, and the fix is in runc 1.1.12.
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
First seen exploited 3 months after disclosure. Public exploit code (Metasploit) was available the same day.
19 related vulnerabilities in the same code over 9 years. The latest fix listed for github.com/opencontainers/runc is 1.4.0-rc.3.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
15 more CVEs are in this family. See the family tree
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: github.com/opencontainers/runc.
Upgrade to 1.1.12 or later
go get github.com/opencontainers/runc@v1.1.12The first fix for CVE-2024-21626. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 1.0.0-rc93 up to 1.1.12 | 1.1.12 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.