CVE-2024-21626: Runc Container Escape Vulnerability

CVE-2024-21626 Overview

runc is a CLI tool used for spawning and running containers on Linux according to the OCI specification. In versions 1.1.11 and earlier, a vulnerability due to an internal file descriptor leak could allow an attacker to cause a newly-spawned container process to have a working directory in the host filesystem namespace. This could lead to a complete container escape by providing access to the host filesystem.

Critical Impact

This vulnerability allows for container escape by granting container processes unauthorized access to the host filesystem, which can result in overwritten host binaries and potential privilege escalation.

Affected Products

• linuxfoundation runc
• fedoraproject fedora

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to Not Available
• Not Available - CVE CVE-2024-21626 assigned
• Not Available - linuxfoundation releases security patch
• 2024-01-31T22:15:53.780 - CVE CVE-2024-21626 published to NVD
• 2024-11-21T08:54:45.180 - Last updated in NVD database

Technical Details for CVE-2024-21626

Vulnerability Analysis

The vulnerability exists in the way runc implements file descriptor management. The leak enables a process within a container to inherit file descriptors that should be limited to host processes, leading to an escape from the container's chroot jail.

Root Cause

A failure in closing file descriptors properly within the runc exec module results in unintended leakage of host filesystem references into the container environment.

Attack Vector

Local access is required to exploit this vulnerability, making it exploitable by any processes running within a compromised or malicious container image.

// Example exploitation code (sanitized)
# Python script to demonstrate file descriptor leakage
import os

# Simulate a new process in the container
pid = fork()
if pid == 0:
    # Access leaked file descriptor (hypothetical)
    with open('/etc/hostfile', 'r') as fd:
        data = fd.read()
        print("Leaked data: ", data)

Detection Methods for CVE-2024-21626

Indicators of Compromise

• Unexpected file creation in host-only directory
• Anomalous process execution within containers
• Unauthorized access attempts to host resources

Detection Strategies

Utilize anomaly detection within file system access logs to identify unauthorized access attempts from containerized processes. Monitor for unexpected socket connections and unusual file descriptor activity within the containerized apps.

Monitoring Recommendations

Leverage SentinelOne’s endpoint detection and response capabilities to monitor for behavior anomalies and unauthorized file access. Ensure comprehensive logging of container interactions with host resources.

How to Mitigate CVE-2024-21626

Immediate Actions Required

• Restrict container privileges to the minimum necessary
• Validate container images to ensure integrity
• Implement mandatory access controls on host filesystems

Patch Information

Apply the security patch provided in runc version 1.1.12 as detailed in the official advisory here.

Workarounds

As a temporary workaround, ensure containers run with additional filesystem namespace isolation and employ application-level security to mitigate potential impacts.

# Configuration example
docker run --security-opt=no-new-privileges