How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as "Leaky Vessels," is a critical runc container escape vulnerability. It allows malicious containers to break isolation and gain root access to the host system. This high-severity flaw impacts Docker, Kubernetes, and other runc-based environments.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 is a runc vulnerability where a file descriptor leak can be exploited. Malicious containers with access to `/proc/self/fd` can leverage this leak to bypass container isolation. This allows an attacker to execute arbitrary code with root privileges on the host system. It affects runc versions prior to 1.1.12.
Impact and Risks for your Infrastructure
The primary impact is a complete container escape, granting root access to the host. This can lead to full system compromise, data exfiltration, service disruption, and unauthorized resource usage across your infrastructure. Business operations relying on affected containerized applications are at severe risk.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or higher. For Docker, Kubernetes, or containerd, update your runtime components. Verify the fix by checking your runc version and ensuring all container hosts are running the patched software.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.