CVE-2024-21626

Name of the Vulnerable Software and Affected Versions runc versions 1.0.0-rc93 through 1.1.11 containerd versions 1.4.7 through 1.6.27 containerd versions 1.7.0 through 1.7.12 Docker versions 20.10.8 through 24.0.8 Docker versions 24.0.9 through 25.0.2

Description An internal file descriptor leak in runc, a CLI tool for spawning and running containers on Linux according to the OCI specification, allows for multiple container breakouts. The issue occurs because a file descriptor remains open during the setcwd(2) operation, even when O CLOEXEC is used on all descriptors before executing container code. An attacker can maintain a reference to the host filesystem by configuring the working directory to a path resolved through this leaked descriptor. This can be exploited via runc exec to set a working directory in the host filesystem namespace or via a malicious image using runc run to gain host filesystem access. Furthermore, these methods can be used to overwrite semi-arbitrary host binaries, leading to a complete container escape and arbitrary code execution on the host.

Recommendations Update runc to version 1.1.12. Update containerd to version 1.6.28 or 1.7.13. Update Docker to version 24.0.9 or 25.0.2. As a temporary mitigation, close all unneeded file descriptors to prevent the leak from being exploited.