CVE-2024-21626 runc container breakout through process.cwd trickery and leaked fds
Attackers can escape containers and execute code on the host by exploiting a file descriptor leak that exposes the host filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-21626?
CVE-2024-21626 is a high-severity path traversal vulnerability in Fedoraproject Fedora, published on 31 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
Which versions are affected by CVE-2024-21626?
3 open source packages ship an affected version, including github.com/opencontainers/runc. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/opencontainers/runc Go | From 1.0.0-rc93 | 1.1.12 |
github.com/opencontainers/runc Go | From 1.0.0-rc93 | 1.1.12 |
github.com/opencontainers/runc Go | From 1.0.0-rc93 | 1.1.12 |
Linux distribution packages (37)
aardvark-dns AlmaLinux:8 | All versions | 2:1.7.0-1.module_el8.9.0+3657+d86e192f |
buildah AlmaLinux:8 | All versions | 1:1.31.3-3.module_el8.9.0+3717+81096349 |
buildah-tests AlmaLinux:8 | All versions | 1:1.31.3-3.module_el8.9.0+3717+81096349 |
cockpit-podman AlmaLinux:8 | All versions | 75-1.module_el8.9.0+3643+9234dc3b |
conmon AlmaLinux:8 | All versions | 3:2.1.8-1.module_el8.9.0+3643+9234dc3b |
container-selinux AlmaLinux:8 | All versions | 2:2.221.0-1.module_el8.9.0+3643+9234dc3b |
containernetworking-plugins AlmaLinux:8 | All versions | 1:1.3.0-8.module_el8.9.0+3717+81096349 |
containers-common AlmaLinux:8 | All versions | 2:1-71.module_el8.9.0+3717+81096349 |
crit AlmaLinux:8 | All versions | 3.18-4.module_el8.9.0+3643+9234dc3b |
criu AlmaLinux:8 | All versions | 3.18-4.module_el8.9.0+3643+9234dc3b |
criu-devel AlmaLinux:8 | All versions | 3.18-4.module_el8.9.0+3643+9234dc3b |
criu-libs AlmaLinux:8 | All versions | 3.18-4.module_el8.9.0+3643+9234dc3b |
crun AlmaLinux:8 | All versions | 1.8.7-1.module_el8.9.0+3643+9234dc3b |
fuse-overlayfs AlmaLinux:8 | All versions | 1.12-1.module_el8.9.0+3643+9234dc3b |
libslirp AlmaLinux:8 | All versions | 4.4.0-1.module_el8.8.0+3615+3543c705 |
libslirp-devel AlmaLinux:8 | All versions | 4.4.0-1.module_el8.8.0+3615+3543c705 |
netavark AlmaLinux:8 | All versions | 2:1.7.0-2.module_el8.9.0+3717+81096349 |
oci-seccomp-bpf-hook AlmaLinux:8 | All versions | 1.2.9-1.module_el8.9.0+3643+9234dc3b |
podman AlmaLinux:8 | All versions | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
podman-catatonit AlmaLinux:8 | All versions | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
podman-docker AlmaLinux:8 | All versions | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
podman-gvproxy AlmaLinux:8 | All versions | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
podman-plugins AlmaLinux:8 | All versions | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
podman-remote AlmaLinux:8 | All versions | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
podman-tests AlmaLinux:8 | All versions | 3:4.6.1-8.module_el8.9.0+3717+81096349 |
python3-criu AlmaLinux:8 | All versions | 3.18-4.module_el8.9.0+3643+9234dc3b |
python3-podman AlmaLinux:8 | All versions | 4.6.0-2.module_el8.9.0+3717+81096349 |
runc AlmaLinux:8 | All versions | 1:1.1.12-1.module_el8.9.0+3717+81096349 |
skopeo AlmaLinux:8 | All versions | 2:1.13.3-3.module_el8.9.0+3717+81096349 |
skopeo-tests AlmaLinux:8 | All versions | 2:1.13.3-3.module_el8.9.0+3717+81096349 |
slirp4netns AlmaLinux:8 | All versions | 1.2.1-1.module_el8.9.0+3643+9234dc3b |
toolbox AlmaLinux:8 | All versions | 0.0.99.4-5.module_el8.9.0+3643+9234dc3b |
toolbox-tests AlmaLinux:8 | All versions | 0.0.99.4-5.module_el8.9.0+3643+9234dc3b |
udica AlmaLinux:8 | All versions | 0.2.6-20.module_el8.8.0+3615+3543c705 |
runc AlmaLinux:9 | All versions | 4:1.1.12-1.el9_3 |
aardvark-dns Red Hat:enterprise_linux:8::appstream | All versions | 2:1.7.0-1.module+el8.9.0+21243+a586538b |
buildah Red Hat:enterprise_linux:8::appstream | All versions | 1:1.31.3-3.module+el8.9.0+21243+a586538b |
Products include Fedoraproject Fedora, Linuxfoundation Runc.
How do I fix CVE-2024-21626?
Upgrade github.com/opencontainers/runc to 1.1.12 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-21626 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21626 exists.
Public exploit code: 1 Metasploit module and 20 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALSA-2024:0670, ALSA-2024:0752, AZL-34060, AZL-34074, AZL-34075, AZL-34087 and 45 more.