How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, known as "Leaky Vessels," is a high-severity runc container escape vulnerability (CVSS 8.6). This critical flaw allows an attacker to break out of container isolation and gain root privileges on the host system. It impacts widely used container runtimes like Docker and Kubernetes.
What is runc Container Escape – Leaky Vessels?
CVE-2024-21626 exploits a file descriptor leak within runc, the low-level container runtime. Specifically, a container with access to /proc/self/fd can leverage this leak to bypass namespace isolation. This allows an attacker to execute arbitrary commands as root on the underlying host system, effectively escaping the container.
Impact and Risks for your Infrastructure
The primary impact is a complete compromise of the host system from within an affected container. Attackers can gain root access, leading to data exfiltration, service disruption, or further lateral movement within your infrastructure. This poses a severe risk to any environment utilizing runc-based containerization.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, update runc to version 1.1.12 or higher immediately. For Docker, Kubernetes, or containerd, ensure your underlying runc package is patched. Verify the fix by checking your runc version and confirming it's 1.1.12 or newer.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.