Vulnerability · Published Jan 31, 2024 · Assigned by GitHub_M
CVE-2024-21626runc container breakout through process.cwd trickery and leaked fds
High 8.6
In plain English
A high-severity information exposure in runc from opencontainers. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 18.9% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)18.9%top 2.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Metasploit, Public PoC
Official description
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aardvark-dns | 2:1.0.1-38.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | aardvark-dns | 2:1.7.0-1.module_el8.9.0+3657+d86e192f | ALSA-2024:0752 |
| AlmaLinux:8 | buildah | 1:1.24.6-7.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | buildah | 1:1.31.3-3.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | buildah-tests | 1:1.24.6-7.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | buildah-tests | 1:1.31.3-3.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | buildah-tests | 1:1.24.6-7.module_el8.9.0+3687+dcd7ef8f | ALSA-2024:0748 |
| AlmaLinux:8 | cockpit-podman | 75-1.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | cockpit-podman | 46-1.module_el8.7.0+3344+5bcd850f | ALSA-2024:0748 |
| AlmaLinux:8 | conmon | 2:2.1.4-2.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | conmon | 2:2.1.4-2.module_el8.9.0+3687+dcd7ef8f | ALSA-2024:0748 |
| AlmaLinux:8 | conmon | 3:2.1.8-1.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | container-selinux | 2:2.221.0-1.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | container-selinux | 2:2.205.0-3.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.1.1-6.module_el8.9.0+3711+04fcca5e | ALSA-2024:0748 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.3.0-8.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | containers-common | 2:1-71.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | containers-common | 2:1-38.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | crit | 3.18-4.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | crit | 3.15-3.module_el8.6.0+3137+d33c3efb | ALSA-2024:0748 |
| AlmaLinux:8 | crit | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux:8 | criu | 3.15-3.module_el8.6.0+3137+d33c3efb | ALSA-2024:0748 |
| AlmaLinux:8 | criu | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux:8 | criu | 3.18-4.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | criu-devel | 3.15-3.module_el8.6.0+3137+d33c3efb | ALSA-2024:0748 |
| AlmaLinux:8 | criu-devel | 3.18-4.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | criu-devel | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux:8 | criu-libs | 3.18-4.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | criu-libs | 3.15-3.module_el8.6.0+3137+d33c3efb | ALSA-2024:0748 |
| AlmaLinux:8 | criu-libs | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux:8 | crun | 1.8.7-1.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | crun | 1.8.7-1.module_el8.9.0+3683+33eb0feb | ALSA-2024:0748 |
| AlmaLinux:8 | fuse-overlayfs | 1.12-1.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | fuse-overlayfs | 1.9-2.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | libslirp | 4.4.0-1.module_el8.8.0+3615+3543c705 | ALSA-2024:0752 |
| AlmaLinux:8 | libslirp | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux:8 | libslirp | 4.4.0-1.module_el8.6.0+3137+d33c3efb | ALSA-2024:0748 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-1.module_el8.8.0+3615+3543c705 | ALSA-2024:0752 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-1.module_el8.6.0+3137+d33c3efb | ALSA-2024:0748 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux:8 | netavark | 2:1.0.1-38.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | netavark | 2:1.7.0-2.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.5-2.module_el8.8.0+3468+16b86c82 | ALSA-2024:0748 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.9-1.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | podman | 3:4.6.1-8.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | podman | 2:4.0.2-26.module_el8.9.0+3722+7fd8ab2b.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | podman-catatonit | 3:4.6.1-8.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | podman-catatonit | 2:4.0.2-26.module_el8.9.0+3722+7fd8ab2b.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | podman-docker | 3:4.6.1-8.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | podman-docker | 2:4.0.2-26.module_el8.9.0+3722+7fd8ab2b.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | podman-gvproxy | 3:4.6.1-8.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | podman-gvproxy | 2:4.0.2-26.module_el8.9.0+3722+7fd8ab2b.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | podman-plugins | 2:4.0.2-26.module_el8.9.0+3722+7fd8ab2b.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | podman-plugins | 3:4.6.1-8.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | podman-remote | 3:4.6.1-8.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | podman-remote | 2:4.0.2-26.module_el8.9.0+3722+7fd8ab2b.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | podman-tests | 3:4.6.1-8.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | podman-tests | 2:4.0.2-26.module_el8.9.0+3722+7fd8ab2b.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | python3-criu | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux:8 | python3-criu | 3.15-3.module_el8.6.0+3137+d33c3efb | ALSA-2024:0748 |
| AlmaLinux:8 | python3-criu | 3.18-4.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | python3-podman | 4.6.0-2.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | python3-podman | 4.0.0-2.module_el8.9.0+3711+04fcca5e | ALSA-2024:0748 |
| AlmaLinux:8 | runc | 1:1.1.12-1.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | runc | 1:1.1.12-1.module_el8.9.0+3722+7fd8ab2b | ALSA-2024:0748 |
| AlmaLinux:9 | runc | 4:1.1.12-1.el9_3 | ALSA-2024:0670 |
| AlmaLinux:8 | skopeo | 2:1.6.2-9.module_el8.9.0+3687+dcd7ef8f.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | skopeo | 2:1.6.2-9.module_el8.9.0+3711+04fcca5e.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | skopeo | 2:1.13.3-3.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | skopeo-tests | 2:1.13.3-3.module_el8.9.0+3717+81096349 | ALSA-2024:0752 |
| AlmaLinux:8 | skopeo-tests | 2:1.6.2-9.module_el8.9.0+3687+dcd7ef8f.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | skopeo-tests | 2:1.6.2-9.module_el8.9.0+3711+04fcca5e.alma.1 | ALSA-2024:0748 |
| AlmaLinux:8 | slirp4netns | 1.2.1-1.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | slirp4netns | 1.1.8-3.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | toolbox | 0.0.99.4-5.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | toolbox | 0.0.99.4-5.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.4-5.module_el8.9.0+3643+9234dc3b | ALSA-2024:0752 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.4-5.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux:8 | udica | 0.2.6-20.module_el8.8.0+3615+3543c705 | ALSA-2024:0752 |
| AlmaLinux:8 | udica | 0.2.6-4.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| Alpine:v3.20 | runc | 1.1.12-r0 | ALPINE-CVE-2024-21626 |
| Alpine:v3.21 | runc | 1.1.12-r0 | ALPINE-CVE-2024-21626 |
| Alpine:v3.22 | runc | 1.1.12-r0 | ALPINE-CVE-2024-21626 |
| Alpine:v3.23 | runc | 1.1.12-r0 | ALPINE-CVE-2024-21626 |
| Alpine:v3.24 | runc | 1.1.12-r0 | ALPINE-CVE-2024-21626 |
| Debian:12 | runc | 1.1.5+ds1-1+deb12u1 | DEBIAN-CVE-2024-21626 |
| Debian:12 | runc | 1.1.5+ds1-1+deb12u1 | DSA-5615-1 |
| Debian:13 | runc | 1.1.12+ds1-1 | DEBIAN-CVE-2024-21626 |
| Debian:14 | runc | 1.1.12+ds1-1 | DEBIAN-CVE-2024-21626 |
| Go | github.com/opencontainers/runc | 1.1.12 | GHSA-xr7r-f8xq-vfvv |
| Go | github.com/opencontainers/runc | 1.1.12 | GO-2024-2491 |
| Rocky Linux:8 | buildah | 1:1.24.6-7.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | cockpit-podman | 0:46-1.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | conmon | 2:2.1.4-2.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | container-selinux | 2:2.205.0-3.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | containers-common | 2:1-38.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | criu | 0:3.15-3.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.9-2.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | libslirp | 0:4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2024:0752 |
| Rocky Linux:8 | libslirp | 0:4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.5-2.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | python-podman | 0:4.0.0-2.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | runc | 1:1.1.12-1.module+el8.10.0+1825+623b0c20 | RLSA-2024:0748 |
| Rocky Linux:8 | runc | 1:1.1.12-1.module+el8.10.0+1825+623b0c20 | RLSA-2024:0752 |
| Rocky Linux:8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:0748 |
| Rocky Linux:8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:0752 |
| Rocky Linux:8 | skopeo | 2:1.6.2-9.module+el8.9.0+1578+aa900b44 | RLSA-2024:0748 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-3.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux:8 | udica | 0:0.2.6-4.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Ubuntu:22.04:LTS | runc | 1.1.7-0ubuntu1~22.04.2 | UBUNTU-CVE-2024-21626 |
| Ubuntu:22.04:LTS | runc | 1.1.7-0ubuntu1~22.04.2 | USN-6619-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| opencontainers | runc | >=v1.0.0-rc93, < 1.1.12 |
Weakness: CWE-403, CWE-668, CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv x_refsource_CONFIRM
- https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf x_refsource_MISC
- https://github.com/opencontainers/runc/releases/tag/v1.1.12 x_refsource_MISC
- http://www.openwall.com/lists/oss-security/2024/02/01/1
- http://www.openwall.com/lists/oss-security/2024/02/02/3
- http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J/
- https://lists.debian.org/debian-lts-announce/2024/02/msg00005.html
- https://www.vicarius.io/vsociety/posts/leaky-vessels-part-1-cve-2024-21626
- https://access.redhat.com/security/cve/CVE-2024-21626 vdb-entry, x_refsource_REDHAT
- RHBZ#2258725 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21626.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2024:1270 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0717 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:4597 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0684 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:2441 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0666 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:2701 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0662 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:2710 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0645 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:1711 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:10525 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:10841 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:10149 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:0650 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:10520 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:0115 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0758 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0760 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0757 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0764 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0759 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0748 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0752 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0756 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0755 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:0670 vendor-advisory, x_refsource_REDHAT