How to fix CVE-2024-21626 – Step-by-Step Guide
CVE-2024-21626, also known as "Leaky Vessels," is a high-severity container escape vulnerability in runc (CVSS 8.6). Published on January 31, 2024, it allows attackers to break out of container isolation. This critical flaw affects widely used container runtimes like Docker and Kubernetes.
What is runc Container Escape – Leaky Vessels?
This vulnerability stems from a file descriptor leak within runc, the low-level container runtime. An attacker inside a container can exploit this leak by accessing `/proc/self/fd`. This enables them to escape the container's isolation boundary and gain root privileges on the underlying host system. It impacts any environment using runc, including Docker, Kubernetes, and containerd.
Impact and Risks for your Infrastructure
Successful exploitation of CVE-2024-21626 leads to a complete container escape, granting an attacker root access to the host system. This can result in full compromise of the host, data exfiltration, unauthorized code execution, and potential lateral movement across your infrastructure. The integrity and confidentiality of your entire environment are at severe risk.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-21626, immediately upgrade runc to version 1.1.12 or later. This fix addresses the file descriptor leak. After upgrading, ensure all affected container services (e.g., Docker daemon, Kubelet) are restarted to apply the new runc binary. Verify the update by checking the runc version.
- 1Update runc to 1.1.12 or later.
- 2Update Docker to 25.0.2+ / 24.0.9+ and containerd to 1.7.13+ / 1.6.27+.
- 3Run containers as non-root with --user and --cap-drop=ALL.
- 4Enable Seccomp and AppArmor/SELinux profiles for containers.
- 5Restrict /proc access with read-only mounts where possible.
- 6Run containers in rootless mode (Podman, rootless Docker) for defense-in-depth.