CVE-2024-21626

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-403",
        "CWE-668"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21626.json"
}

References

Affected packages

Git / github.com/opencontainers/runc

Affected ranges

Type

GIT

Repo

https://github.com/opencontainers/runc

Events

Introduced

12644e614e25b05da6fd08a38ffa0cfe1903fdec

Fixed

51d5e94601ceffbbd85688df1c928ecccbfa4685

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "v1.0.0-rc93"
        },
        {
            "fixed":  "1.1.12"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-21626.json"