CVE-2024-21626 : runc is a CLI tool for spawning and running containers on Linux according to the

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

Published 2024-01-31 22:15:54

Updated 2024-02-19 03:15:08

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2024-21626

Fedoraproject » Fedora » Version: 39
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
Matching versions
Linuxfoundation » Runc
Versions before (<) 1.1.12
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2024-21626

EPSS FAQ

4.31%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 88 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2024-21626

runc (docker) File Descriptor Leak Privilege Escalation

Disclosure Date: 2024-01-31

First seen: 2024-02-09

exploit/linux/local/runc_cwd_priv_esc

All versions of runc <=1.1.11, as used by containerization technologies such as Docker engine, and Kubernetes are vulnerable to an arbitrary file write. Due to a file descriptor leak it is possible to mount the host file system with the permissions of runc (t

More information

CVSS scores for CVE-2024-21626

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.6	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	1.8	6.0	NIST	2024-02-09
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: High
8.6	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	1.8	6.0	GitHub, Inc.	2024-01-31
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2024-21626

CWE-403 Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')

A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

Assigned by: security-advisories@github.com (Secondary)
CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)

References for CVE-2024-21626

http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html

runc 1.1.11 File Descriptor Leak Privilege Escalation ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://lists.debian.org/debian-lts-announce/2024/02/msg00005.html

[SECURITY] [DLA 3735-1] runc security update

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2024/02/01/1

oss-security - Re: runc: CVE-2024-21626: high severity container breakout attack
Mailing List

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2024/02/02/3

oss-security - Re: Re: runc: CVE-2024-21626: high severity container breakout attack
Mailing List

CVEs referencing this url
https://github.com/opencontainers/runc/releases/tag/v1.1.12

Release runc 1.1.12 -- "Now you're thinking with Portals™!" · opencontainers/runc · GitHub
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL/

[SECURITY] Fedora 39 Update: runc-1.1.12-1.fc39 - package-announce - Fedora Mailing-Lists
Mailing List
https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv

container breakout through process.cwd trickery and leaked fds · Advisory · opencontainers/runc · GitHub
Exploit;Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J/

[SECURITY] Fedora 38 Update: runc-1.1.12-1.fc38 - package-announce - Fedora Mailing-Lists
https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf

Merge pull request from GHSA-xr7r-f8xq-vfvv · opencontainers/runc@0212048 · GitHub
Patch

Jump to