How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, dubbed "Leaky Vessels," is a critical runc container escape vulnerability. It carries a high severity CVSS score of 8.6 and impacts popular container runtimes like Docker, Kubernetes, and containerd. This flaw allows attackers to break out of container isolation.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak within runc, the low-level container runtime. An attacker inside a container can exploit this leak by manipulating file descriptors accessible via /proc/self/fd. This allows them to bypass container isolation and execute arbitrary code with root privileges on the host system.
Impact and Risks for your Infrastructure
A successful exploit of CVE-2024-21626 leads to full host compromise, granting an attacker root access outside the container. This can result in data breaches, unauthorized system modifications, and complete infrastructure takeover. Critical systems running affected runc versions are at severe risk.
Step-by-Step Mitigation Guide
Immediately update runc to version 1.1.12 or later to patch this vulnerability. For Docker, Kubernetes, or containerd environments, follow vendor-specific upgrade paths to ensure the underlying runc component is updated. Verify the fix by checking your runc version and ensuring it is 1.1.12+.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.