How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as "Leaky Vessels," is a high-severity container escape vulnerability in runc. It allows attackers to break out of container isolation and gain root privileges on the host system. This critical flaw impacts Docker, Kubernetes, and other runc-based container runtimes.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 stems from a file descriptor leak in runc, specifically versions prior to 1.1.12. An attacker within a container can exploit this leak via `/proc/self/fd` to gain unauthorized access to host file descriptors. This allows them to bypass container isolation and execute commands with root privileges on the underlying host system.
Impact and Risks for your Infrastructure
The primary impact is a full container escape, granting attackers root access to the host system. This can lead to complete system compromise, data exfiltration, service disruption, and unauthorized resource usage across your infrastructure. Affected systems include Docker, Kubernetes, and containerd environments.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, immediately update runc to version 1.1.12 or later. For Docker, Kubernetes, or containerd, ensure your container runtime is updated to include the patched runc version. Verify the fix by checking your runc version and confirming it is 1.1.12 or higher.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.