How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, dubbed "Leaky Vessels," is a high-severity runc container escape vulnerability. It allows attackers to break out of container isolation and gain root access to the host system. This critical flaw impacts Docker, Kubernetes, and other runc-based container runtimes.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 is a runc file descriptor leak. When a container is created, runc can inadvertently pass a host file descriptor into the container's process. A malicious container, with access to /proc/self/fd, can then manipulate this leaked FD to gain elevated privileges and escape its sandbox.
Impact and Risks for your Infrastructure
This vulnerability allows a complete compromise of the host system from within a container. Attackers can gain root access, leading to data exfiltration, service disruption, or further lateral movement within your infrastructure. This poses a severe risk to containerized environments.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or higher immediately. For Docker, Kubernetes, or containerd, update your runtime components to versions that bundle the fixed runc. Verify the update by checking your runc version and ensuring all container hosts are patched.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.