How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, also known as "Leaky Vessels," is a high-severity container escape vulnerability in runc. This critical flaw allows attackers to break out of container isolation, impacting Docker, Kubernetes, and other runc-based systems. Immediate action is required to secure your containerized environments.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 is a runc file descriptor leak vulnerability. It allows a malicious container process to retain a reference to a host file descriptor, specifically `/proc/self/fd/N` within the container. By manipulating this leaked FD, an attacker can escape the container sandbox and gain root privileges on the host system.
Impact and Risks for your Infrastructure
This vulnerability leads to a full container escape, granting attackers root access to the underlying host. A compromised host can lead to complete system takeover, data breaches, and disruption of critical services. This poses a severe risk to business continuity and data integrity.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or higher. For Docker, Kubernetes, and containerd, apply the latest security patches provided by your vendor. Verify the fix by checking your runc version and ensuring all container runtimes are updated.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.