How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as 'Leaky Vessels,' is a high-severity container escape vulnerability affecting runc and popular container runtimes like Docker and Kubernetes. This critical flaw allows an attacker to break out of container isolation. Immediate patching is essential to secure your containerized environments.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 is a runc vulnerability stemming from a file descriptor leak. An attacker within a container can exploit this leak by accessing /proc/self/fd, gaining unauthorized access to host file descriptors. This enables them to bypass container isolation and execute arbitrary code with root privileges on the underlying host system.
Impact and Risks for your Infrastructure
The primary impact of CVE-2024-21626 is a complete container escape, granting an attacker root access to the host system. This can lead to full compromise of the host, data exfiltration, service disruption, and lateral movement across your infrastructure. Unpatched systems face severe security risks.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or later immediately. For Docker, Kubernetes, or containerd users, ensure your container runtime packages are updated to versions incorporating the fixed runc. Verify the fix by checking your runc version and confirming successful updates across all affected hosts.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.