Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2024-21626) in runc stems from internal file descriptor (FD) leaks and improper handling of container configurations (process.cwd, process.args) that could leverage these leaked FDs. The analysis of the provided patches identified several key functions that were vulnerable:
libcontainer/cgroups.prepareOpenat2 (missing O_CLOEXEC for /sys/fs/cgroup handle), libcontainer/cgroups/fs.tryDefaultCgroupRoot (missing dir.Close() for /sys/fs/cgroup), and the anonymous action function for main.updateCmd (missing f.Close() for a config file).libcontainer.(*linuxContainer).start did not set O_CLOEXEC on non-stdio FDs before spawning runc init.libcontainer.finalizeNamespace did not validate that process.cwd was inside the container, allowing a leaked host FD path to grant host filesystem access.libcontainer.(*linuxStandardInit).Init and libcontainer.(*linuxSetnsInit).Init did not close all leaked FDs before execve, allowing a process.args[0] path constructed with a leaked host FD to execute/overwrite host binaries.The patches address these issues by ensuring FDs are closed or marked O_CLOEXEC, and by adding validation for the container's working directory. The identified functions represent the locations where the vulnerabilities manifested, either by causing the leaks or by failing to handle the consequences of such leaks, thereby enabling the described container escape scenarios.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/opencontainers/runc | go | >= 1.0.0-rc93, <= 1.1.11 | 1.1.12 |