# CVE-2024-21626

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

- Page: https://www.vulneraibility.com/cve/CVE-2024-21626
- CVSS: 8.6
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 18.92% (percentile 97.3)
- Public exploit code: 1 Metasploit module · 20 GitHub proofs of concept (first 2024-02-01)
- CISA SSVC: exploitation poc, automatable no, technical impact total (assessed 2024-04-19)
- Weakness: CWE-403, CWE-668, CWE-200
- Published: 2024-01-31

## Affected versions

- opencontainers runc: affected < 1.1.12

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv
- [other] https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf
- [other] https://github.com/opencontainers/runc/releases/tag/v1.1.12
- [other] http://www.openwall.com/lists/oss-security/2024/02/01/1
- [other] http://www.openwall.com/lists/oss-security/2024/02/02/3
- [other] http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html
- [other] https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL/
- [other] https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J/
- [other] https://lists.debian.org/debian-lts-announce/2024/02/msg00005.html
- [other] https://www.vicarius.io/vsociety/posts/leaky-vessels-part-1-cve-2024-21626
- [other] https://access.redhat.com/security/cve/CVE-2024-21626
- [other] https://bugzilla.redhat.com/show_bug.cgi?id=2258725
- [other] https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21626.json
- [advisory] https://access.redhat.com/errata/RHSA-2024:1270
- [advisory] https://access.redhat.com/errata/RHSA-2024:0717
- [advisory] https://access.redhat.com/errata/RHSA-2024:4597
- [advisory] https://access.redhat.com/errata/RHSA-2024:0684
- [advisory] https://access.redhat.com/errata/RHSA-2025:2441
- [advisory] https://access.redhat.com/errata/RHSA-2024:0666
- [advisory] https://access.redhat.com/errata/RHSA-2025:2701
- [advisory] https://access.redhat.com/errata/RHSA-2024:0662
- [advisory] https://access.redhat.com/errata/RHSA-2025:2710
- [advisory] https://access.redhat.com/errata/RHSA-2024:0645
- [advisory] https://access.redhat.com/errata/RHSA-2025:1711
- [advisory] https://access.redhat.com/errata/RHSA-2024:10525
- [advisory] https://access.redhat.com/errata/RHSA-2024:10841
- [advisory] https://access.redhat.com/errata/RHSA-2024:10149
- [advisory] https://access.redhat.com/errata/RHSA-2025:0650
- [advisory] https://access.redhat.com/errata/RHSA-2024:10520
- [advisory] https://access.redhat.com/errata/RHSA-2025:0115
- [advisory] https://access.redhat.com/errata/RHSA-2024:0758
- [advisory] https://access.redhat.com/errata/RHSA-2024:0760
- [advisory] https://access.redhat.com/errata/RHSA-2024:0757
- [advisory] https://access.redhat.com/errata/RHSA-2024:0764
- [advisory] https://access.redhat.com/errata/RHSA-2024:0759
- [advisory] https://access.redhat.com/errata/RHSA-2024:0748
- [advisory] https://access.redhat.com/errata/RHSA-2024:0752
- [advisory] https://access.redhat.com/errata/RHSA-2024:0756
- [advisory] https://access.redhat.com/errata/RHSA-2024:0755
- [advisory] https://access.redhat.com/errata/RHSA-2024:0670

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.