How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, dubbed 'Leaky Vessels,' is a critical runc container escape vulnerability. This high-severity flaw (CVSS 8.6) allows attackers to break out of container isolation. It impacts popular container runtimes like Docker, Kubernetes, and containerd.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak within runc, the low-level container runtime. Specifically, a container with access to /proc/self/fd can exploit this leak. This allows an attacker to bypass container isolation mechanisms. The flaw ultimately grants them root access to the underlying host system.
Impact and Risks for your Infrastructure
The primary impact is a full container escape, leading to host root compromise. An attacker can gain control over the host system, accessing sensitive data, disrupting services, or deploying further malware. This poses a severe risk to the integrity and security of your entire containerized infrastructure.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or higher immediately. For Docker, Kubernetes, or containerd, ensure your environment uses the patched runc version. Verify the fix by checking your runc version and confirming successful updates across all affected hosts.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.