How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as 'Leaky Vessels,' is a high-severity container escape vulnerability in runc. This critical flaw allows attackers to break out of container isolation, posing a significant risk to host systems.
What is runc Container Escape – Leaky Vessels?
This vulnerability is a file descriptor leak in runc, the core component of many container runtimes. An attacker within a container can exploit this leak via `/proc/self/fd` to bypass isolation and gain root access on the host system. It impacts Docker, Kubernetes, and other runc-based environments.
Impact and Risks for your Infrastructure
The primary impact is a complete container escape, granting an attacker root access to the host system. This allows for full compromise of the underlying infrastructure, potential data exfiltration, service disruption, and lateral movement across your environment. Unpatched systems are at severe risk.
Step-by-Step Mitigation Guide
To mitigate, update runc to version 1.1.12 or higher immediately. For Docker, Kubernetes, or containerd users, ensure your runtime environment is updated to incorporate the patched runc version. Verify the fix by checking your runc version (`runc --version`) to confirm it's 1.1.12+.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.