How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, also known as "Leaky Vessels," is a critical runc container escape vulnerability. It allows attackers to break out of container isolation and gain root privileges on the host system. This high-severity flaw affects widely used container runtimes.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 is a file descriptor leak in runc, the low-level container runtime. Specifically, it allows a malicious container process to gain access to sensitive host file descriptors via /proc/self/fd. This bypasses container isolation, leading to a full container escape and host compromise. It impacts runc versions prior to 1.1.12.
Impact and Risks for your Infrastructure
Successful exploitation of CVE-2024-21626 grants an attacker root access to the host system from within a container. This enables full compromise of the underlying infrastructure, data exfiltration, and disruption of critical services. It poses a severe risk to containerized environments.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or later immediately. For Docker, Kubernetes, and containerd users, this means updating your container runtime or distribution. Verify the fix by checking your runc version and ensuring all hosts are running the patched software.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.