How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as "Leaky Vessels," is a high-severity runc container escape vulnerability (CVSS 8.6). It allows attackers to break out of container isolation and gain root access to the host system. This critical flaw affects Docker, Kubernetes, and other runc-based container runtimes.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 is a runc vulnerability where a file descriptor leak allows a malicious container to escape its isolation. By exploiting this leak via /proc/self/fd, an attacker can gain root privileges on the host system. This critical flaw affects runc versions prior to 1.1.12, impacting containerized environments.
Impact and Risks for your Infrastructure
The primary impact is a complete container escape, leading to root-level compromise of the host system. This allows attackers to access, modify, or destroy host resources, potentially disrupting critical services and exfiltrating sensitive data. Infrastructure running affected runc versions is at severe risk.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or later immediately. For Docker, Kubernetes, and containerd users, ensure your underlying runc package is updated. Verify the fix by checking your runc version (`runc --version`) and confirming it is 1.1.12+.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.