How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as "Leaky Vessels," is a critical runc container escape vulnerability. It allows attackers to break out of container isolation and gain root access to the host system. This high-severity flaw impacts Docker, Kubernetes, and other runc-based environments.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak within runc, the low-level container runtime. Specifically, containers with access to /proc/self/fd can exploit this leak. It enables an attacker to bypass container isolation and execute arbitrary commands on the underlying host.
Impact and Risks for your Infrastructure
A successful exploit leads to full host compromise, allowing attackers root access outside the container. This can result in data breaches, complete system takeover, and severe operational disruption. Critical infrastructure running affected container platforms is at high risk.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, immediately upgrade runc to version 1.1.12 or newer. For Docker, Kubernetes, or containerd, update your container runtime packages to ensure the patched runc version is deployed. Verify the fix by checking your runc version and confirming it's 1.1.12+.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.