How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as "Leaky Vessels," is a high-severity container escape vulnerability in runc (CVSS 8.6). Published on January 31, 2024, it allows attackers to break out of container isolation. This critical flaw affects widely used container runtimes like Docker, Kubernetes, and containerd.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 is a file descriptor leak vulnerability in runc, the low-level container runtime. It allows a malicious container to gain access to sensitive file descriptors from the host system. By exploiting this leak, an attacker can escape the container's isolation boundary and achieve root privileges on the underlying host. This affects runc versions prior to 1.1.12.
Impact and Risks for your Infrastructure
This vulnerability leads to a full container escape, granting attackers root access to the host system. A compromised container can then fully compromise the host, potentially impacting all other containers and services running on it. This poses a severe risk to infrastructure integrity and data confidentiality.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or later immediately. For Docker, Kubernetes, and containerd users, this means updating your container runtime packages. Verify the fix by checking your runc version (runc --version) to ensure it's 1.1.12 or higher.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.