How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as 'Leaky Vessels,' is a high-severity runc vulnerability (CVSS 8.6). It enables container escape, critically impacting systems using Docker, Kubernetes, and other runc-based container runtimes. Immediate action is required to prevent host compromise.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak within runc, the low-level container runtime. An attacker inside a container can exploit this leak by manipulating file descriptors accessible via /proc/self/fd. This allows them to break out of the container's isolation boundaries, gaining unauthorized root privileges on the underlying host system.
Impact and Risks for your Infrastructure
A successful exploit of CVE-2024-21626 leads to full host compromise, granting an attacker root access outside the container. This can result in data breaches, complete system takeover, and disruption of critical services. All runc-based containerized environments are at severe risk.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or higher immediately. For Docker, Kubernetes, or containerd, follow their respective upgrade paths to ensure the underlying runc component is patched. Verify the fix by checking your runc version is 1.1.12+.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.