erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: January 31, 2024

1 editorial brief, 2 known exploited (cisa kev) additions and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Patch this week: Leaky Vessels. Anyone running containers on Linux with runc 1.1.11 or earlier, most urgently CI runners, shared build hosts and multi-tenant clusters that run images or Dockerfiles from others.
  • Do you run any of these? Ivanti Connect Secure, Policy Secure, and Neurons, Apple Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-02-02.
  • Go: 2 critical advisories (github.com/moby/buildkit). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2024-21626, CVE-2024-23651

Leaky Vessels: runc Container Escape (CVE-2024-21626)

A real container escape, but it needs you to run an attacker-controlled image or a crafted exec; patch runc everywhere promptly, urgently where untrusted images or multi-tenant builds run.

Must act: Anyone running containers on Linux with runc 1.1.11 or earlier, most urgently CI runners, shared build hosts and multi-tenant clusters that run images or Dockerfiles from others.

Can relax: Hosts already on runc 1.1.12 or later, and single-tenant hosts running only trusted, pinned images, which still should patch but on a normal cycle.

  1. Check your runc version with `runc --version` (and `docker info` or `containerd --version` on managed nodes) and upgrade to runc 1.1.12 or later.
  2. Update Docker Engine to 25.0.2 / 24.0.9 or later and BuildKit to 0.12.5 or later.
  3. Patch Kubernetes node images through your provider or distro; managed nodes often bundle runc.

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2024-21893Ivanti Connect Secure, Policy Secure, and Neurons
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability Ransomware		2024-02-02
CVE-2022-48618Apple Multiple Products
Apple Multiple Products Memory Corruption Vulnerability		2024-02-21

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 2

Check: govulncheck ./...