How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as 'Leaky Vessels,' is a critical runc container escape vulnerability with a CVSS score of 8.6. This high-severity flaw impacts container runtimes like Docker, Kubernetes, and containerd, allowing attackers to break out of container isolation.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak within runc, the low-level container runtime. Specifically, runc fails to properly close file descriptors when handling certain operations. An attacker inside a container can exploit this leak via /proc/self/fd to gain unauthorized access and elevate privileges to root on the host system.
Impact and Risks for your Infrastructure
The primary impact is a complete container escape, granting an attacker root access to the underlying host. This allows for full compromise of the host system, potential data exfiltration, service disruption, and lateral movement across your infrastructure. Unpatched systems are at severe risk of total compromise.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update your runc installation to version 1.1.12 or later immediately. For Docker, Kubernetes, or containerd, ensure you are running updated versions that bundle runc 1.1.12+. Verify the fix by checking your runc version and ensuring no vulnerable versions are present.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.