CVE-2024-21626

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21626.json",
    "cwe_ids": [
        "CWE-403",
        "CWE-668"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/opencontainers/runc

Affected ranges

Type

GIT

Repo

https://github.com/opencontainers/runc

Events

Introduced

12644e614e25b05da6fd08a38ffa0cfe1903fdec

Fixed

51d5e94601ceffbbd85688df1c928ecccbfa4685

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "v1.0.0-rc93"
        },
        {
            "fixed": "1.1.12"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-21626.json"