How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, dubbed "Leaky Vessels," is a high-severity runc container escape vulnerability (CVSS 8.6). Published January 31, 2024, it allows attackers to break out of container isolation. This critical flaw can lead to host system compromise, affecting Docker, Kubernetes, and containerd.
What is runc Container Escape – Leaky Vessels?
This runc vulnerability involves a file descriptor leak during container execution. A malicious container can access host file descriptors via /proc/self/fd, bypassing isolation. This allows an attacker to gain root access on the host system. It affects runc versions prior to 1.1.12.
Impact and Risks for your Infrastructure
The primary impact is a complete container escape, granting attackers root access to the host system. This can lead to full infrastructure compromise, data exfiltration, and service disruption across your containerized environment. Critical business operations are at severe risk.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or later immediately. For Docker, Kubernetes, or containerd, ensure their underlying runc dependency is updated. Verify the fix by checking your runc version and confirming no vulnerable instances remain.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.