How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, also known as "Leaky Vessels," is a high-severity container escape vulnerability affecting runc. This critical flaw allows malicious containers to break out of their isolation and gain root access to the host system. It impacts popular container runtimes like Docker, Kubernetes, and containerd.
What is runc Container Escape – Leaky Vessels?
The vulnerability, CVE-2024-21626, stems from a file descriptor leak in runc versions prior to 1.1.12. An attacker within a container can exploit this leak by manipulating `/proc/self/fd`. This allows them to bypass container isolation mechanisms and execute arbitrary code on the underlying host.
Impact and Risks for your Infrastructure
Successful exploitation of CVE-2024-21626 leads to a full container escape, granting the attacker root privileges on the host system. This can result in complete compromise of the host infrastructure, data exfiltration, service disruption, and further lateral movement within your network.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, immediately update runc to version 1.1.12 or higher. For Docker, Kubernetes, or containerd users, ensure your container runtime packages are updated to include the patched runc version. Verify the fix by checking your runc version and confirming it's 1.1.12+.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.