How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as 'Leaky Vessels,' is a high-severity container escape vulnerability affecting runc. This critical flaw allows malicious containers to break out of their isolation and gain unauthorized access to the host system. It impacts widely used container runtimes like Docker, Kubernetes, and containerd.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak within runc, the low-level container runtime. Specifically, a container with access to /proc/self/fd can exploit this leak. It allows the container to gain elevated privileges, ultimately leading to a complete escape from its intended isolation boundary. This grants the attacker root access on the underlying host.
Impact and Risks for your Infrastructure
The primary impact is a full container escape, granting an attacker root privileges on the host system. This can lead to complete system compromise, data exfiltration, and disruption of critical services. All containerized applications running on affected runc versions are at risk of unauthorized access and control.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or higher immediately. For Docker, Kubernetes, or containerd, follow vendor-specific upgrade paths to ensure the underlying runc is patched. Verify the fix by checking your runc version and confirming it's 1.1.12+.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.