How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as 'Leaky Vessels,' is a high-severity runc container escape vulnerability (CVSS 8.6). It allows attackers to break out of container isolation, impacting systems using Docker, Kubernetes, and other runc-based runtimes. Immediate patching is crucial to prevent host compromise.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak in runc, the low-level container runtime. Runc fails to properly close file descriptors when creating new containers. An attacker within a container can exploit this leak via /proc/self/fd to gain elevated privileges and escape the container's isolation, achieving root access on the host system.
Impact and Risks for your Infrastructure
The primary impact is a full container escape, granting attackers root access to the host system. This allows for complete compromise of the underlying infrastructure, data exfiltration, and lateral movement across your environment. Unpatched systems face severe risks to data integrity and operational continuity.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or higher. For Docker and Kubernetes, this typically involves updating your container runtime or platform components. Verify the fix by checking your runc version (runc --version) and ensuring it's 1.1.12 or newer, then restart affected services.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.