How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as 'Leaky Vessels,' is a critical runc container escape vulnerability. It allows attackers to break out of container isolation, gaining root access to the host system. This high-severity flaw impacts Docker, Kubernetes, and other runc-based environments.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak within runc, the low-level container runtime. An attacker inside a container can exploit this leak via `/proc/self/fd` to bypass namespace isolation. This grants them elevated privileges, specifically root access, on the underlying host system. It's a fundamental breach of container security.
Impact and Risks for your Infrastructure
The primary impact is a full container escape, leading to root compromise of the host. This allows an attacker to access, modify, or destroy any data and resources on the host, including other containers. It poses a severe risk to data confidentiality, integrity, and availability across your infrastructure.
Step-by-Step Mitigation Guide
To fix CVE-2024-21626, immediately update runc to version 1.1.12 or higher. For Docker, Kubernetes, or containerd, update your container runtime packages to versions that bundle runc 1.1.12+. Verify the fix by checking your runc version (`runc --version`) and ensuring it's 1.1.12+.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.