erroneo.us
Search all guides⌘K

Security Digest · Vulnerability record

CVE-2024-21626: runc container breakout through process.cwd trickery and leaked fds

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification.

CVSS 8.6 High EPSS 18.9% · p97 Patch this week

Updated By erroneo.us Security Desk42 references

Should you act?

High exploit likelihood

EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

  • Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
  • EPSS 18.9%, percentile 97: FIRST’s model estimates a 18.9% chance of exploitation activity in the next 30 days, higher than 97% of all scored CVEs (very high). EPSS is a probability, not a verdict.
  • Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.
  • Editorial verdict: Patch this week. Leaky Vessels: runc Container Escape (CVE-2024-21626) — A real container escape, but it needs you to run an attacker-controlled image or a crafted exec; patch runc everywhere promptly, urgently where untrusted images or multi-tenant builds run.

What it is

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

Weakness type: CWE-403, CWE-668, CWE-200.

Product: opencontainers runc · Assigned by: GitHub_M · Published: 2024-01-31

Affected and fixed versions

VendorProductAffected versions (per CVE record)
opencontainersrunc>=v1.0.0-rc93, < 1.1.12

Severity scores

Scored byCVSSScoreVector
GitHub_M3.18.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
redhat-SADP3.18.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
  • Attack vector: local access needed
  • Attack complexity: low
  • Privileges required: none (no login)
  • User interaction: required (a user must click/open something)
  • Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

  • CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
  • CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
  • FIRST EPSS (model of 2026-10-21): 18.92% probability of exploitation activity in the next 30 days; percentile 97.

Timeline

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

  1. access.redhat.com access.redhat.com
  2. access.redhat.com access.redhat.com
  3. access.redhat.com access.redhat.com
  4. access.redhat.com access.redhat.com
  5. access.redhat.com access.redhat.com
  6. access.redhat.com access.redhat.com
  7. access.redhat.com access.redhat.com
  8. access.redhat.com access.redhat.com
  9. access.redhat.com access.redhat.com
  10. access.redhat.com access.redhat.com
  11. access.redhat.com access.redhat.com
  12. access.redhat.com access.redhat.com
  13. access.redhat.com access.redhat.com
  14. access.redhat.com access.redhat.com
  15. access.redhat.com access.redhat.com
  16. access.redhat.com access.redhat.com
  17. access.redhat.com access.redhat.com
  18. access.redhat.com access.redhat.com
  19. access.redhat.com access.redhat.com
  20. access.redhat.com access.redhat.com
  21. access.redhat.com access.redhat.com
  22. access.redhat.com access.redhat.com
  23. access.redhat.com access.redhat.com
  24. access.redhat.com access.redhat.com
  25. access.redhat.com access.redhat.com
  26. access.redhat.com access.redhat.com
  27. access.redhat.com access.redhat.com

Vulnerability records

  1. CVE.org record CVE-2024-21626 cve.org
  2. NVD entry CVE-2024-21626 nvd.nist.gov

Other references from the CVE record and advisory

  1. github.com github.com
  2. github.com github.com
  3. github.com github.com
  4. openwall.com openwall.com
  5. openwall.com openwall.com
  6. packetstormsecurity.com packetstormsecurity.com
  7. lists.fedoraproject.org lists.fedoraproject.org
  8. lists.fedoraproject.org lists.fedoraproject.org
  9. lists.debian.org lists.debian.org
  10. vicarius.io vicarius.io
  11. access.redhat.com access.redhat.com
  12. RHBZ#2258725 bugzilla.redhat.com
  13. security.access.redhat.com security.access.redhat.com

Today’s Security Digest