Lifubang

**Name of the Vulnerable Software and Affected Versions** runc versions 1.0.0-rc93 through 1.1.11 containerd versions 1.4.7 through 1.6.27 containerd versions 1.7.0 through 1.7.12 Docker versions 20.10.8 through 24.0.8 Docker versions 24.0.9 through 25.0.2 **Description** An internal file descriptor leak in runc, a CLI tool for spawning and running containers on Linux according to the OCI specification, allows for multiple container breakouts. The issue occurs because a file descriptor remains open during the `setcwd(2)` operation, even when `O CLOEXEC` is used on all descriptors before executing container code. This allows a reference to be maintained within the container by configuring the working directory to a path resolved through that file descriptor. Exploitation can occur in several ways: - A newly-spawned container process via `runc exec` can have a working directory in the host filesystem namespace, granting access to the host filesystem. - A malicious image can use `runc run` to gain access to the host filesystem. - Variants of these methods can be used to overwrite semi-arbitrary host binaries, leading to a complete container escape and arbitrary code execution outside the isolated environment. **Recommendations** Update runc to version 1.1.12. Update containerd to version 1.6.28 or 1.7.13. Update Docker to version 24.0.9 or 25.0.2. As a temporary mitigation, close all unneeded file descriptors to prevent the leak from being exploited.