PT-2024-1467 · Unknown+12 · Kubernetes Containerd+12
CVSS v3.1
8.6
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
runc versions 1.0.0-rc93 through 1.1.11
containerd versions 1.4.7 through 1.6.27
containerd versions 1.7.0 through 1.7.12
Docker versions 20.10.8 through 24.0.8
Docker versions 24.0.9 through 25.0.2
Description
An internal file descriptor leak in runc, a CLI tool for spawning and running containers on Linux according to the OCI specification, allows for multiple container breakouts. The issue occurs because a file descriptor remains open during the
setcwd(2) operation, even when O CLOEXEC is used on all descriptors before executing container code. This allows a reference to be maintained within the container by configuring the working directory to a path resolved through that file descriptor.Exploitation can occur in several ways:
- A newly-spawned container process via
runc execcan have a working directory in the host filesystem namespace, granting access to the host filesystem. - A malicious image can use
runc runto gain access to the host filesystem. - Variants of these methods can be used to overwrite semi-arbitrary host binaries, leading to a complete container escape and arbitrary code execution outside the isolated environment.
Recommendations
Update runc to version 1.1.12.
Update containerd to version 1.6.28 or 1.7.13.
Update Docker to version 24.0.9 or 25.0.2.
As a temporary mitigation, close all unneeded file descriptors to prevent the leak from being exploited.
Exploit
Fix
RCE
Exposure of Resource to Wrong Sphere
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Check Point Gaia
Docker
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Kubernetes Containerd
Runc