How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as 'Leaky Vessels,' is a critical runc container escape vulnerability. It allows attackers to break out of container isolation, gaining root access to the host system. This high-severity flaw impacts Docker, Kubernetes, and other runc-based environments.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak within runc, the low-level container runtime. Specifically, runc versions prior to 1.1.12 fail to properly close file descriptors when creating new containers. An attacker inside a container can exploit this leak via /proc/self/fd to gain elevated privileges and escape to the host.
Impact and Risks for your Infrastructure
The primary impact is a complete compromise of the host system from within an exploited container. Attackers can achieve root access, leading to data exfiltration, service disruption, or further lateral movement within your infrastructure. This poses a severe risk to any environment utilizing runc-based containerization.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or higher immediately. For Docker, Kubernetes, or containerd, follow their respective update procedures to ensure runc is patched. Verify the fix by checking your runc version (runc --version) and confirming it's 1.1.12+.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.