How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as "Leaky Vessels," is a critical runc container escape vulnerability. This high-severity flaw allows attackers to break out of container isolation and gain root access to the host system. It impacts widely used container runtimes like Docker, Kubernetes, and containerd.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 is a file descriptor leak in runc, specifically affecting versions prior to 1.1.12. This vulnerability occurs when runc incorrectly handles file descriptors, making them accessible to a malicious container. An attacker can exploit this leak via `/proc/self/fd` to bypass container isolation, granting them unauthorized root privileges on the underlying host system.
Impact and Risks for your Infrastructure
The primary impact is a complete container escape, leading to root compromise of the host system. An attacker can execute arbitrary code, access sensitive data, or disrupt operations across your entire infrastructure. This poses severe risks to business operations, including potential data breaches and system downtime.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or later immediately. For Docker, Kubernetes, or containerd, ensure your runtime components are updated to versions incorporating the fix. Verify the update by checking your runc version and confirming no vulnerable containers are running.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.