--- title: "CVE-2024-21626: runc container breakout through process.cwd trickery and leaked fds" url: https://erroneo.us/security/cve/CVE-2024-21626/ description: "CVE-2024-21626 (opencontainers runc): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and…" type: vulnerability-record section: "Security Digest" date_published: 2024-01-31 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk cve: "CVE-2024-21626" kev: false cvss: 8.6 epss: 0.18923 license: All rights reserved. Quote with attribution and a link. --- # CVE-2024-21626: runc container breakout through process.cwd trickery and leaked fds **Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.) ## Should you act? - Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists. - EPSS 18.9% , percentile 97: FIRST’s model estimates a 18.9% chance of exploitation activity in the next 30 days, higher than 97% of all scored CVEs (very high). EPSS is a probability, not a verdict. - Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine. - Editorial verdict: Patch this week. Leaky Vessels: runc Container Escape (CVE-2024-21626) — A real container escape, but it needs you to run an attacker-controlled image or a crafted exec; patch runc everywhere promptly, urgently where untrusted images or multi-tenant builds run. ## What it is runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue. ## Affected products (CVE record) - opencontainers runc: >=v1.0.0-rc93, < 1.1.12 ## Severity - GitHub_M CVSS 3.1: 8.6 `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` - redhat-SADP CVSS 3.1: 8.6 `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` ## Exploitation - CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA). - CISA SSVC assessment: exploitation poc , automatable no , technical impact total . - FIRST EPSS (model of 2026-10-21): 18.92% probability of exploitation activity in the next 30 days; percentile 97. ## Sources - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:1270) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0717) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:4597) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0684) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2025:2441) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0666) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2025:2701) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0662) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2025:2710) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0645) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2025:1711) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:10525) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:10841) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:10149) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2025:0650) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:10520) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2025:0115) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0758) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0760) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0757) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0764) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0759) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0748) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0752) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0756) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0755) - [access.redhat.com](https://access.redhat.com/errata/RHSA-2024:0670) - [CVE.org record CVE-2024-21626](https://www.cve.org/CVERecord?id=CVE-2024-21626) - [NVD entry CVE-2024-21626](https://nvd.nist.gov/vuln/detail/CVE-2024-21626) - [github.com](https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv) - [github.com](https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf) - [github.com](https://github.com/opencontainers/runc/releases/tag/v1.1.12) - [openwall.com](http://www.openwall.com/lists/oss-security/2024/02/01/1) - [openwall.com](http://www.openwall.com/lists/oss-security/2024/02/02/3) - [packetstormsecurity.com](http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html) - [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL/) - [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J/) - [lists.debian.org](https://lists.debian.org/debian-lts-announce/2024/02/msg00005.html) - [vicarius.io](https://www.vicarius.io/vsociety/posts/leaky-vessels-part-1-cve-2024-21626) - [access.redhat.com](https://access.redhat.com/security/cve/CVE-2024-21626) - [RHBZ#2258725](https://bugzilla.redhat.com/show_bug.cgi?id=2258725) - [security.access.redhat.com](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21626.json) --- Source page: https://erroneo.us/security/cve/CVE-2024-21626/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt