How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as "Leaky Vessels," is a critical runc container escape vulnerability. It allows attackers to break out of container isolation and gain root access to the host system. This high-severity flaw impacts Docker, Kubernetes, and other runc-based environments.
What is runc Container Escape – Leaky Vessels?
This vulnerability is a file descriptor leak in runc, specifically affecting versions prior to 1.1.12. An attacker within a container can exploit this leak via /proc/self/fd to bypass container isolation. This grants them unauthorized root privileges on the underlying host system, compromising the entire environment.
Impact and Risks for your Infrastructure
Successful exploitation leads to full host compromise, allowing an attacker to execute arbitrary code with root privileges outside the container. This can result in data exfiltration, service disruption, or further lateral movement within your infrastructure. The integrity and confidentiality of your systems are severely at risk.
Step-by-Step Mitigation Guide
To fix CVE-2024-21626, immediately upgrade runc to version 1.1.12 or later. For Docker, Kubernetes, or containerd, ensure your runtime components are updated to versions incorporating the fix. Verify the update by checking your runc version (`runc --version`) and confirming it's 1.1.12+.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.