How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, dubbed "Leaky Vessels," is a critical runc container escape vulnerability. It allows attackers to break out of container isolation and gain root access on the host system. This high-severity flaw impacts Docker, Kubernetes, and other runc-based environments.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak within runc, the low-level container runtime. An attacker inside a container can exploit this leak, specifically via /proc/self/fd, to gain unauthorized access to host file descriptors. This bypasses container isolation, escalating privileges to root on the underlying host.
Impact and Risks for your Infrastructure
Successful exploitation leads to a complete container escape, granting an attacker root privileges on the host system. This can result in full compromise of the host, data exfiltration, service disruption, and potential lateral movement across your infrastructure. The impact is severe for any affected containerized environment.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, immediately upgrade runc to version 1.1.12 or later. For Docker, Kubernetes, or containerd users, update your container runtime packages. Verify the fix by checking your runc version and ensuring all affected hosts are running the patched software.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.