CVE-2024-21626

runc container breakout through process.cwd trickery and leaked fds

En bref

Sévérité: HIGH 8.6
EPSS: EPSS 18.92 % · centile 97 (2026-10-27)
État: PUBLISHED
Publiée: 2024-01-31
Mise à jour: 2026-09-17
Attribuée par: GitHub_M
Statut NVD: Modified

Description

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	GitHub_M
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	redhat-SADP
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Faiblesses (CWE)

Avis

GHSA-xr7r-f8xq-vfvv — runc vulnerable to container breakout through process.cwd trickery and leaked fds
GO-2024-2491 — Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

Références européennes

ENISA EUVD · EUVD-2024-0459
GCVE · GCVE-0-2024-21626

Avis du CERT-FR

CERTFR-2026-AVI-0249 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0459 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* < 1.1.12
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
opencontainers · runc	affected >=v1.0.0-rc93, < 1.1.12

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD