How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, also known as "Leaky Vessels," is a high-severity container escape vulnerability affecting runc, the core runtime for Docker, Kubernetes, and containerd. This critical flaw allows an attacker to break out of container isolation, posing a significant risk to host system security.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 is a file descriptor leak in runc versions prior to 1.1.12. This flaw occurs when runc incorrectly handles file descriptors, making them accessible outside the container's intended scope. An attacker can exploit this leak via /proc/self/fd to gain unauthorized root access to the host system, bypassing container isolation.
Impact and Risks for your Infrastructure
The primary impact is a full container escape, leading to root-level compromise of the host system. This allows an attacker to execute arbitrary code, access sensitive data, or disrupt operations on the underlying infrastructure. It severely undermines the security model of containerized environments.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or higher. For Docker, Kubernetes, or containerd users, update your container runtime to a version that bundles runc 1.1.12+. Verify the fix by checking your runc version and ensuring no vulnerable instances remain.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.