CVE-2024-21626: opencontainers runc container breakout via leaked file descriptors

CVE-2024-21626 · Severity: high · CVSS 8.6 · Published 2024-01-31

runc, a widely used tool for spawning and running containers, is vulnerable to a container breakout. An attacker can exploit leaked file descriptors to gain access to the host's filesystem or overwrite host binaries. This could allow a malicious container to take full control of the underlying server, potentially leading to data theft or service disruption.

Technologies: github.com/opencontainers/runc (Go), Open Container Initiative Runc. Vendors: Go, Open Container Initiative.

Quick answers

Is CVE-2024-21626 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-21626 being exploited in the wild.
How severe is CVE-2024-21626?
High severity, with a CVSS score of 8.6, published 31 January 2024.
Which products and versions are affected?
github.com/opencontainers/runc (Go) >= 1.0.0-rc93, <= 1.1.11, SEMVER:introduced=1.0.0-rc93,fixed=1.1.12; Open Container Initiative Runc >= 1.0.0-rc93, <= 1.1.11.
Is there a fix for CVE-2024-21626?
Yes. github.com/opencontainers/runc (Go): upgrade to 1.1.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-21626 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2024-21626?
Check whether you run github.com/opencontainers/runc (Go) or Open Container Initiative Runc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/opencontainers/runc (Go): upgrade to 1.1.12 or later
    go get github.com/opencontainers/runc@v1.1.12

Technical details

runc 1.1.11 and earlier contains multiple vulnerabilities related to internal file descriptor leaks (specifically /sys/fs/cgroup) and a lack of verification that the working directory remains within the container's mount namespace after chdir(2). An attacker can exploit this by setting a malicious process.cwd (e.g., /proc/self/fd/7/) or using symlinks to trick runc into executing processes with a working directory on the host. Furthermore, by using magic-links like /proc/self/fd/7/../../../bin/bash as process.args, an attacker can execute and subsequently overwrite host binaries. These issues are addressed in runc 1.1.12 by validating the working directory via getcwd() and ensuring all internal file descriptors are closed or marked O_CLOEXEC before execution.

Affected products

  • opencontainers runc >= 1.0.0-rc93, <= 1.1.11

Identifiers

  • CVE-2024-21626
  • GHSA-xr7r-f8xq-vfvv
  • GO-2024-2491

Timeline

  • 2024-01-31: disclosed
  • 2024-01-31: advisory
  • 2024-01-31: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.