CVE-2024-21626 in the critical feed json
runc container breakout through process.cwd trickery and leaked fds
published 2024-01-31 2 y ago modified 2026-09-17 53 d ago also GHSA-xr7r-f8xq-vfvv , GO-2024-2491 , EUVD-2024-0459
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 18.9%
- EPSS 18.9% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Metasploit
Summary
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
Patch / fix
- go github.com/opencontainers/runc 1.1.12
- Red Hat OCP-Tools-4.15-RHEL-8 0:2.440.3.1718879390-3.el8, 0:4.15.1718879538-1.el8
- Red Hat Red Hat Enterprise Linux 7 Extras 0:1.0.0-70.rc10.el7_9, 2:1.13.1-210.git7d71120.el7_9
- Red Hat Red Hat Enterprise Linux 8 8090020240201111813.d7b6f4b7, 8090020240201111839.d7b6f4b7
- Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020240206120705.28c38760
- Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service 8020020240206120705.28c38760
- Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions 8020020240206120705.28c38760
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020240207051234.c0c392d5
- Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 8040020240207051234.c0c392d5
- Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 8040020240207051234.c0c392d5
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support 8060020240205133014.3b538bd8, 8060020240206151655.3b538bd8
- Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 8080020240206143933.0f77c1b7
- Red Hat Red Hat Enterprise Linux 9 4:1.1.12-1.el9_3
- Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support 4:1.1.12-1.el9_0
- Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 4:1.1.12-1.el9_2
- Red Hat Red Hat OpenShift Container Platform 4.11 3:1.1.2-3.1.rhaos4.11.el8
- Red Hat Red Hat OpenShift Container Platform 4.12 3:1.1.6-5.1.rhaos4.12.el8, v4.12.0-202503030130.p0.g7c2a284.assembly.stream.el8
- Red Hat Red Hat OpenShift Container Platform 4.13 4:1.1.12-1.rhaos4.13.el8, v4.13.0-202503111300.p0.gb379980.assembly.stream.el8
- Red Hat Red Hat OpenShift Container Platform 4.14 0:4.14.42-202411280904.p0.gcf4d04f.assembly.4.14.42.el9, 4:1.1.12-1.rhaos4.14.el8, v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8
- Red Hat Red Hat OpenShift Container Platform 4.15 0:4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9, v4.15.0-202502171304.p0.gb74eb6d.assembly.stream.el8
- Red Hat Red Hat OpenShift Container Platform 4.16 0:4.16.24-202411220522.p0.gcc4fedc.assembly.4.16.24.el9, v4.16.0-202501160405.p0.g300d9ad.assembly.stream.el9
- Red Hat Red Hat OpenShift Container Platform 4.17 0:4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9, v4.17.0-202501052337.p0.gbb33e13.assembly.stream.el9
- runc Debian 12 1.1.5+ds1-1+deb12u1
- runc Debian 14, Debian 13 1.1.12+ds1-1
debian advisories DEBIAN-CVE-2024-21626
- runc Ubuntu 20.04 LTS 1.1.7-0ubuntu1~20.04.2
- runc Ubuntu 22.04 LTS 1.1.7-0ubuntu1~22.04.2
- runc Ubuntu Pro 18.04 LTS 1.1.4-0ubuntu1~18.04.2+esm1
ubuntu advisories UBUNTU-CVE-2024-21626
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- microshift openshift 4.18 4.18.1-202502201910.p0.g84f67ec.assembly.4.18.1.el9
- microshift-olm openshift 4.18 4.18.1-202502201910.p0.g84f67ec.assembly.4.18.1.el9
- microshift-multus openshift 4.18 4.18.1-202502201910.p0.g84f67ec.assembly.4.18.1.el9
- microshift-selinux openshift 4.18 4.18.1-202502201910.p0.g84f67ec.assembly.4.18.1.el9
- microshift-greenboot openshift 4.18 4.18.1-202502201910.p0.g84f67ec.assembly.4.18.1.el9
- microshift-networking openshift 4.18 4.18.1-202502201910.p0.g84f67ec.assembly.4.18.1.el9
- microshift-gateway-api openshift 4.18 4.18.1-202502201910.p0.g84f67ec.assembly.4.18.1.el9
- microshift-low-latency openshift 4.18 4.18.1-202502201910.p0.g84f67ec.assembly.4.18.1.el9
red hat advisories RHEA-2024:6124RHSA-2024:10841RHSA-2024:10525RHSA-2024:10520RHSA-2024:10149RHSA-2024:0764
- runc SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +18 more 1.1.12-150000.61.2
- runc SLE Module for Containers 12 1.1.12-16.46.1
- runc SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +21 more 1.1.11-150000.58.1
- runc SLE Module for Containers 12 1.1.11-16.43.1
suse advisories SUSE-SU-2024:0459-1SUSE-SU-2024:0328-1SUSE-SU-2024:0295-1SUSE-SU-2024:0294-1
- crun Package Hub 15 SP6, openSUSE Leap 15.6 1.20-bp156.2.3.1
- singularity-ce openSUSE Tumbleweed 4.1.3-1.1
- runc openSUSE Tumbleweed 1.1.12-1.1
- crun openSUSE Tumbleweed 1.14.4-1.1
opensuse advisories openSUSE-SU-2025:0074-1openSUSE-SU-2024:14059-1openSUSE-SU-2024:13644-1openSUSE-SU-2024:13754-1
- crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
- crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
- criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
- criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
- crun AlmaLinux 8 1.8.7-1.module_el8.9.0+3683+33eb0feb
- runc AlmaLinux 8 1:1.1.12-1.module_el8.9.0+3722+7fd8ab2b
- udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155
- conmon AlmaLinux 8 2:2.1.4-2.module_el8.9.0+3627+db8ec155
almalinux advisories ALSA-2024:0748ALSA-2024:0752ALSA-2024:0670
- criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
- runc Rocky Linux 8 1:1.1.12-1.module+el8.10.0+1815+5fe7415e
- runc Rocky Linux 8 1:1.1.12-1.module+el8.10.0+1825+623b0c20
- udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
- conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
- skopeo Rocky Linux 8 2:1.6.2-9.module+el8.9.0+1578+aa900b44
- buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
- libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297
rocky linux advisories RLSA-2024:0748RLSA-2024:0752
- runc Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 1.1.12-r0
alpine advisories ALPINE-CVE-2024-21626
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- cri-tools CBL-Mariner 2.0 1.28.0-5
- kubernetes CBL-Mariner 2.0 1.28.4-3
- kubevirt CBL-Mariner 2.0 0.59.0-14
- moby-runc CBL-Mariner 2.0 1.1.9-4
- cri-tools Azure Linux 3.0 1.30.1-1
- kubernetes Azure Linux 3.0 1.30.1-1
- kubevirt Azure Linux 3.0 1.2.0-1
- moby-engine Azure Linux 3.0 25.0.3-1
azure linux advisories AZL-34060AZL-34074AZL-34075AZL-34087AZL-34642AZL-34896
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-21626 updated cvss 8.6
runc: file descriptor leak
-
Red Hat OpenShift Developer Tools and Services ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-agent-base-rhel8 Red Hat Power monitoring for Red Hat OpenShift kepler-containeraffected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, openshift-kube-scheduler, +6 more Red Hat OpenShift Virtualization 4 kubevirt, container-native-virtualization/virt-api, container-native-virtualization/virt-handler, container-native-virtualization/virt-launcher, container-native-virtualization/virt-operator, container-native-virtualization/virt-api-rhel9, +15 moreaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Quay 3 quay/quay-builder-rhel8affected: workaround, no fix available
-
Red Hat OpenShift Developer Tools and Services for OCP 4.15 jenkins 2.440.3.1718879390-3.el8, jenkins-2-plugins 4.15.1718879538-1.el8fixed: vendor fix RHSA-2024:4597
-
Red Hat Enterprise Linux 7 Extras runc 1.0.0-70.rc10.el7_9, docker 1.13.1-210.git7d71120.el7_9, docker-client 1.13.1-210.git7d71120.el7_9, docker-common 1.13.1-210.git7d71120.el7_9, docker-logrotate 1.13.1-210.git7d71120.el7_9, docker-lvm-plugin 1.13.1-210.git7d71120.el7_9, +3 morefixed: vendor fix RHSA-2024:1270
-
Red Hat Enterprise Linux AppStream (v. 8) crit 3.15-3.module+el8.9.0+21242+944321bb, crit 3.18-4.module+el8.9.0+21243+a586538b, criu 3.15-3.module+el8.9.0+21242+944321bb, criu 3.18-4.module+el8.9.0+21243+a586538b, crun 1.8.7-1.module+el8.9.0+21242+944321bb, crun 1.8.7-1.module+el8.9.0+21243+a586538b, +60 morefixed: vendor fix RHSA-2024:0748
-
Red Hat Enterprise Linux AppStream (v. 9) runc 1.1.12-1.el9_3fixed: vendor fix RHSA-2024:0670
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) crit 3.12-9.module+el8.2.0+21264+96602818, criu 3.12-9.module+el8.2.0+21264+96602818, udica 0.2.1-2.module+el8.2.0+21264+96602818, conmon 2.0.6-1.module+el8.2.0+21264+96602818, podman 1.6.4-24.module+el8.2.0+21264+96602818, skopeo 0.1.40-9.module+el8.2.0+21264+96602818, +16 morefixed: vendor fix RHSA-2024:0758
show 17 moreshow fewer
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) crit 3.15-1.module+el8.4.0+21078+a96cfbf6, criu 3.15-1.module+el8.4.0+21078+a96cfbf6, crun 0.18-2.module+el8.4.0+21078+a96cfbf6, udica 0.2.4-1.module+el8.4.0+21078+a96cfbf6, skopeo 1.2.2-8.module+el8.4.0+21078+a96cfbf6, conmon 2.0.26-1.module+el8.4.0+21078+a96cfbf6, +20 morefixed: vendor fix RHSA-2024:0760
-
Red Hat Enterprise Linux AppStream E4S (v. 8.2) crit 3.12-9.module+el8.2.0+21264+96602818, criu 3.12-9.module+el8.2.0+21264+96602818, udica 0.2.1-2.module+el8.2.0+21264+96602818, conmon 2.0.6-1.module+el8.2.0+21264+96602818, podman 1.6.4-24.module+el8.2.0+21264+96602818, skopeo 0.1.40-9.module+el8.2.0+21264+96602818, +16 morefixed: vendor fix RHSA-2024:0758
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) crit 3.15-1.module+el8.4.0+21078+a96cfbf6, criu 3.15-1.module+el8.4.0+21078+a96cfbf6, crun 0.18-2.module+el8.4.0+21078+a96cfbf6, udica 0.2.4-1.module+el8.4.0+21078+a96cfbf6, skopeo 1.2.2-8.module+el8.4.0+21078+a96cfbf6, conmon 2.0.26-1.module+el8.4.0+21078+a96cfbf6, +20 morefixed: vendor fix RHSA-2024:0760
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) crun 1.5-1.module+el8.6.0+21266+3e24c7b3, crit 3.15-3.module+el8.6.0+21254+7ef668f8, crit 3.15-3.module+el8.6.0+21266+3e24c7b3, criu 3.15-3.module+el8.6.0+21254+7ef668f8, criu 3.15-3.module+el8.6.0+21266+3e24c7b3, crun 1.4.4-1.module+el8.6.0+21254+7ef668f8, +60 morefixed: vendor fix RHSA-2024:0757
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) crit 3.15-4.module+el8.8.0+21265+93802b02, criu 3.15-4.module+el8.8.0+21265+93802b02, crun 1.8.4-2.module+el8.8.0+21265+93802b02, runc 1.1.12-1.module+el8.8.0+21265+93802b02, conmon 2.1.6-1.module+el8.8.0+21265+93802b02, udica 0.2.6-20.module+el8.8.0+21265+93802b02, +27 morefixed: vendor fix RHSA-2024:0759
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) runc 1.1.12-1.el9_0fixed: vendor fix RHSA-2024:0756
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) runc 1.1.12-1.el9_2fixed: vendor fix RHSA-2024:0755
-
Red Hat Enterprise Linux AppStream TUS (v. 8.2) crit 3.12-9.module+el8.2.0+21264+96602818, criu 3.12-9.module+el8.2.0+21264+96602818, udica 0.2.1-2.module+el8.2.0+21264+96602818, conmon 2.0.6-1.module+el8.2.0+21264+96602818, podman 1.6.4-24.module+el8.2.0+21264+96602818, skopeo 0.1.40-9.module+el8.2.0+21264+96602818, +16 morefixed: vendor fix RHSA-2024:0758
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) crit 3.15-1.module+el8.4.0+21078+a96cfbf6, criu 3.15-1.module+el8.4.0+21078+a96cfbf6, crun 0.18-2.module+el8.4.0+21078+a96cfbf6, udica 0.2.4-1.module+el8.4.0+21078+a96cfbf6, skopeo 1.2.2-8.module+el8.4.0+21078+a96cfbf6, conmon 2.0.26-1.module+el8.4.0+21078+a96cfbf6, +20 morefixed: vendor fix RHSA-2024:0760
-
Red Hat OpenShift Container Platform 4.11 runc 1.1.2-3.1.rhaos4.11.el8fixed: vendor fix RHSA-2024:0684
-
Red Hat OpenShift Container Platform 4.12 runc 1.1.6-5.1.rhaos4.12.el8, openshift4/ose-docker-builder v4.12.0-202503030130.p0.g7c2a284.assembly.stream.el8fixed: vendor fix RHSA-2025:2441
-
Red Hat OpenShift Container Platform 4.13 runc 1.1.12-1.rhaos4.13.el8, runc 1.1.12-1.rhaos4.13.el9, openshift4/ose-docker-builder v4.13.0-202503111300.p0.gb379980.assembly.stream.el8fixed: vendor fix RHSA-2025:2701
-
Red Hat OpenShift Container Platform 4.14 runc 1.1.12-1.rhaos4.14.el8, runc 1.1.12-1.rhaos4.14.el9, microshift 4.14.42-202411280904.p0.gcf4d04f.assembly.4.14.42.el9, microshift-selinux 4.14.42-202411280904.p0.gcf4d04f.assembly.4.14.42.el9, microshift-greenboot 4.14.42-202411280904.p0.gcf4d04f.assembly.4.14.42.el9, microshift-networking 4.14.42-202411280904.p0.gcf4d04f.assembly.4.14.42.el9, +2 morefixed: vendor fix RHSA-2025:2710
-
Red Hat OpenShift Container Platform 4.15 microshift 4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9, microshift-olm 4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9, microshift-selinux 4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9, microshift-greenboot 4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9, microshift-networking 4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9, microshift-release-info 4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9, +2 morefixed: vendor fix RHSA-2025:1711
-
Red Hat OpenShift Container Platform 4.16 microshift 4.16.24-202411220522.p0.gcc4fedc.assembly.4.16.24.el9, microshift-olm 4.16.24-202411220522.p0.gcc4fedc.assembly.4.16.24.el9, microshift-multus 4.16.24-202411220522.p0.gcc4fedc.assembly.4.16.24.el9, microshift-selinux 4.16.24-202411220522.p0.gcc4fedc.assembly.4.16.24.el9, microshift-greenboot 4.16.24-202411220522.p0.gcc4fedc.assembly.4.16.24.el9, microshift-networking 4.16.24-202411220522.p0.gcc4fedc.assembly.4.16.24.el9, +4 morefixed: vendor fix RHSA-2024:10149
-
Red Hat OpenShift Container Platform 4.17 microshift 4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9, microshift-olm 4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9, microshift-multus 4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9, microshift-selinux 4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9, microshift-greenboot 4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9, microshift-networking 4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9, +5 morefixed: vendor fix RHSA-2024:10520
-
Red Hat Ironic content for Red Hat OpenShift Container Platform 4.14 python3-ironic-python-agent 9.6.1-0.20240103100525.3197b9d.el9, openstack-ironic-python-agent 9.6.1-0.20240103100525.3197b9d.el9, python3-ironic-python-agent-tests 9.6.1-0.20240103100525.3197b9d.el9 Red Hat Enterprise Linux 9 podman, buildah, podman-tests, buildah-tests, podman-docker, podman-remote, +3 more Red Hat Enterprise Linux 10 podman, buildah, containers-common Red Hat OpenShift Container Platform 4 cri-o, podman, buildah, cri-tools, podman-tests, buildah-tests, +13 more Red Hat OpenShift Container Platform 4.11 perf 4.18.0-372.91.1.el8_6, kernel 4.18.0-372.91.1.el8_6, bpftool 4.18.0-372.91.1.el8_6, kernel-core 4.18.0-372.91.1.el8_6, kernel-tools 4.18.0-372.91.1.el8_6, python3-perf 4.18.0-372.91.1.el8_6, +35 more Red Hat OpenShift Container Platform 4.12 perf 4.18.0-372.89.1.el8_6, rhcos 412.86.202503052321-0, kernel 4.18.0-372.89.1.el8_6, bpftool 4.18.0-372.89.1.el8_6, kernel-core 4.18.0-372.89.1.el8_6, kernel-tools 4.18.0-372.89.1.el8_6, +224 morenot affected: vulnerable code not present
+5 more productsfewer
Red Hat OpenShift Container Platform 4.13 cri-tools 1.26.0-4.el8, cri-tools 1.26.0-4.1.el9, perf 5.14.0-284.50.1.el9_2, rtla 5.14.0-284.50.1.el9_2, rhcos 413.92.202503112237-0, bpftool 7.0.0-284.50.1.el9_2, +260 more Red Hat OpenShift Container Platform 4.14 cri-tools 1.27.0-3.el8, cri-tools 1.27.0-3.el9, crun 1.14-1.rhaos4.14.el8, crun 1.14-1.rhaos4.14.el9, perf 5.14.0-284.50.1.el9_2, rtla 5.14.0-284.50.1.el9_2, +278 more Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202502141247-0, openshift4/ose-cli v4.15.0-202502171304.p0.g8231637.assembly.stream.el8, openshift4/ose-tests v4.15.0-202502171304.p0.g1ec9664.assembly.stream.el8, openshift4/ose-console v4.15.0-202502172235.p0.g68767b8.assembly.stream.el8, openshift4/ose-deployer v4.15.0-202502172235.p0.g8231637.assembly.stream.el8, openshift4/ose-installer v4.15.0-202502172235.p0.g64866ce.assembly.stream.el8, +187 more Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202501220853-0, openshift4/ose-pod-rhel9 v4.16.0-202501220505.p0.gef2a55c.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.16.0-202501221605.p0.gffc141f.assembly.stream.el9, openshift4/ose-console-rhel9 v4.16.0-202501172006.p0.gaeaa642.assembly.stream.el9, openshift4/ose-hyperkube-rhel9 v4.16.0-202501220505.p0.gef2a55c.assembly.stream.el9, openshift4/ose-installer-rhel9 v4.16.0-202501220505.p0.g162d3ad.assembly.stream.el9, +24 more Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202501071621-0, openshift4/frr-rhel9 v4.17.0-202501021936.p0.g377d02f.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.17.0-202501080135.p0.g3019778.assembly.stream.el9, openshift4/ose-tools-rhel9 v4.17.0-202501080135.p0.gf4525b8.assembly.stream.el9, openshift4/ose-console-rhel9 v4.17.0-202501080135.p0.gedbd12e.assembly.stream.el9, openshift4/network-tools-rhel9 v4.17.0-202501080135.p0.g8e170b4.assembly.stream.el9, +13 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (Metasploit exploit/linux/local/runc_cwd_priv_esc)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
18.92% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/local/runc_cwd_priv_esc runc (docker) File Descriptor Leak Privilege Escalation metasploit exploit, excellent rank, 2024-01-31
- github.com https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv referenced PoC, tagged "exploit" by a source, unverified
- packetstormsecurity.com http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| CISA ADP | 3.1 | 8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/opencontainers/runc | >=1.0.0-rc93, <1.1.12 |
1.1.12 |
Affected products
- opencontainers runc
- Red Hat OCP-Tools-4.15-RHEL-8
- Red Hat Red Hat Enterprise Linux 7 Extras
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
- Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
- Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
- Red Hat Red Hat OpenShift Container Platform 4.11
- Red Hat Red Hat OpenShift Container Platform 4.12
- Red Hat Red Hat OpenShift Container Platform 4.13
- Red Hat Red Hat OpenShift Container Platform 4.14
- Red Hat Red Hat OpenShift Container Platform 4.15
- Red Hat Red Hat OpenShift Container Platform 4.16
- Red Hat Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Developer Tools and Services
- Red Hat Power monitoring for Red Hat OpenShift
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat OpenShift Container Platform 4
- Red Hat Red Hat OpenShift Virtualization 4
- Red Hat Red Hat Quay 3
Classification
References
-
github.com
/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf
web, patch
-
github.com
/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv
web, exploit, vendor-advisory, advisory
-
packetstormsecurity.com
/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html
web, exploit, third-party-advisory, vdb-entry
-
access.redhat.com
/errata/RHSA-2024:1270
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0717
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:4597
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0684
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2025:2441
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0666
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2025:2701
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0662
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2025:2710
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0645
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2025:1711
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:10525
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:10841
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:10149
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2025:0650
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:10520
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2025:0115
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0758
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0760
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0757
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0764
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0759
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0748
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0752
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0756
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0755
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2024:0670
vendor-advisory, web
-
github.com
/opencontainers/runc/releases/tag/v1.1.12
web, release-notes
-
openwall.com
/lists/oss-security/2024/02/01/1
mailing-list
-
openwall.com
/lists/oss-security/2024/02/02/3
mailing-list
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL/
mailing-list
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J/
-
lists.debian.org
/debian-lts-announce/2024/02/msg00005.html
web
-
vicarius.io
/vsociety/posts/leaky-vessels-part-1-cve-2024-21626
web
-
access.redhat.com
/security/cve/CVE-2024-21626
vdb-entry, web
-
bugzilla.redhat.com
/show_bug.cgi?id=2258725
issue-tracking, web
-
security.access.redhat.com
/data/csaf/v2/vex/2024/cve-2024-21626.json
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-21626
advisory
-
github.com
/opencontainers/runc
package
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL
web
Sources
- CVE List CVE-2024-21626
- GitHub Advisory GHSA-xr7r-f8xq-vfvv
- NVD CVE-2024-21626
- OSV GO-2024-2491
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.