Security features bypass in runc - CVE-2024-21626

Vulnerability identifier: #VU85991

CSH Severity: High

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-21626

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an internal file descriptor leak that can cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace or a malicious image to allow a container process to gain access to the host filesystem through runc run. A remote attacker can trick the victim into loading a malicious image to bypass sandbox restrictions and execute arbitrary code on the host OS.

runc
moby
Gentoo Linux
Amazon Linux AMI
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Anolis OS
Red Hat Enterprise Linux Workstation
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Fedora
Containers Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
openSUSE Leap
Ubuntu
openEuler
Chrome OS
BuildKit
Nomad Enterprise
crun
containerd
Storage Defender - Resiliency Service
Guardium Data Security Center (GDSC)
APEX Cloud Platform Foundation Software
PowerStore X
PowerStore T
IBM Cloud Pak for Watson AIOps
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Red Hat OpenShift on IBM Cloud
Robotic Process Automation for Cloud Pak
SmartFabric Storage Software
watsonx.data
Intel In-Band Manageability
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
runc (Ubuntu package)
toolbox (Red Hat package)
udica
rust-bootupd (Red Hat package)
coreos-installer (Red Hat package)
docker-runc
runc (Debian package)
runc
runc (Red Hat package)
runc-debuginfo
app-containers/runc
runc-doc
podman-tui
oci-seccomp-bpf-hook
skopeo (Red Hat package)
fuse-overlayfs
spdlog (Red Hat package)
docker-client
docker-common
docker
docker-logrotate
docker-lvm-plugin
docker-novolume-plugin
docker-v1.10-migrator
docker (Red Hat package)
prometheus-podman-exporter
crun (Red Hat package)
cri-o (Red Hat package)
cri-tools (Red Hat package)
buildah (Red Hat package)
conmon (Red Hat package)
ignition (Red Hat package)
container-selinux (Red Hat package)
libslirp-devel
libslirp
podman (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
microshift (Red Hat package)
openshift-ansible (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
rust-afterburn (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
cockpit-podman
ostree (Red Hat package)
rpm-ostree (Red Hat package)
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Red Hat OpenShift GitOps
Red Hat build of MicroShift
SANnav
APEX Cloud Platform for Red Hat OpenShift
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM MQ Operator
IBM Cloud Pak for Business Automation
IBM InfoSphere Information Server
Dell EMC NetWorker vProxy

Install updates from vendor's website.

runc - update to 1.1.12
moby - addressed in versions 24.0.9, 25.0.2
BuildKit - update to 0.12.5
Nomad Enterprise - addressed in versions 1.5.14, 1.6.7
crun - update to 1.14.1
SmartFabric Storage Software - update to 1.4.3
containerd - addressed in versions 1.6.28, 1.7.13
Storage Defender - Resiliency Service - update to 2.0.11
watsonx.data - update to 2.3.1
Guardium Data Security Center (GDSC) - update to 3.7.2
Intel In-Band Manageability - update to 4.2.2
Red Hat OpenShift Container Platform - addressed in versions 4.11.58, 4.12.49, 4.12.50, 4.12.74, 4.13.32, 4.14.11, 4.14.13, 4.15.0, 4.15.40, 4.16.32, 4.17.7, 4.17.12
runc (Ubuntu package) - addressed in versions Ubuntu Pro, 1.1.7-0ubuntu1~20.04.2, 1.1.7-0ubuntu1~22.04.2, 1.1.7-0ubuntu2.2
toolbox (Red Hat package) - update to 0.1.2-1.rhaos4.15.el9
udica - update to 0.2.6-20
rust-bootupd (Red Hat package) - update to 0.2.17-1.el9
coreos-installer (Red Hat package) - update to 0.17.0-3.rhaos4.15.el9
docker-runc - update to 1.0.0 rc3-224
runc (Debian package) - addressed in versions 1.0.0~rc93+ds1-5+deb11u3, 1.1.5+ds1-1+deb12u1
runc - addressed in versions 1.0.0-70.rc10, 1.1.5-3.0.1, 1.1.9-2.0.1, 1.1.12-1
runc (Red Hat package) - addressed in versions 1.0.0-70.rc10.el7_9, 1.1.2-3.1.rhaos4.11.el8, 1.1.6-5.1.rhaos4.12.el8, 1.1.12-1.el9_0, 1.1.12-1.el9_2, 1.1.12-1.el9_3, 1.1.12-1.rhaos4.13.el8, 1.1.12-1.rhaos4.13.el9, 1.1.12-1.rhaos4.14.el8, 1.1.12-1.rhaos4.14.el9, 1.1.12-1.rhaos4.15.el9
runc - update to 1.1.11-1.1
runc-debuginfo - addressed in versions 1.1.11-16.43.1, 1.1.11-150000.58.1, 1.1.12-16.46.1, 1.1.12-150000.61.2
runc - addressed in versions 1.1.11-16.43.1, 1.1.11-150000.58.1, 1.1.12-16.46.1, 1.1.12-150000.61.2
app-containers/runc - update to 1.1.12
runc-doc - update to 1.1.12-1
runc - addressed in versions 1.1.12-1.fc38, 1.1.12-1.fc39
podman-tui - addressed in versions 1.2.3-1.el9, 1.2.3-1.fc39, 1.2.3-1.fc40, 1.2.3-1.fc41
oci-seccomp-bpf-hook - update to 1.2.5-2.0.1
Red Hat OpenShift GitOps - addressed in versions 1.10.0, 1.11
skopeo (Red Hat package) - update to 1.11.2-21.1.rhaos4.15.el9
fuse-overlayfs - update to 1.12-1.0.1
spdlog (Red Hat package) - update to 1.13.0-1.rhaos4.14.el9
docker-client - update to 1.13.1-210.git7d71120
docker-common - update to 1.13.1-210.git7d71120
docker - update to 1.13.1-210.git7d71120
docker-logrotate - update to 1.13.1-210.git7d71120
docker-lvm-plugin - update to 1.13.1-210.git7d71120
docker-novolume-plugin - update to 1.13.1-210.git7d71120
docker-v1.10-migrator - update to 1.13.1-210.git7d71120
docker (Red Hat package) - update to 1.13.1-210.git7d71120.el7_9
prometheus-podman-exporter - addressed in versions 1.13.3-1.el9, 1.13.3-1.fc39, 1.13.3-1.fc40, 1.13.3-1.fc41
crun (Red Hat package) - addressed in versions 1.14-1.rhaos4.14.el8, 1.14-1.rhaos4.14.el9, 1.14-1.rhaos4.15.el9
cri-o (Red Hat package) - addressed in versions 1.24.6-11.1.rhaos4.11.git07f48d1.el8, 1.25.5-7.rhaos4.12.gitaeeaedb.el8, 1.28.3-14.rhaos4.15.git33aabd8.el9
cri-tools (Red Hat package) - addressed in versions 1.26.0-4.el8, 1.26.0-4.1.el9, 1.27.0-3.el8, 1.27.0-3.el9, 1.28.0-3.el9
buildah (Red Hat package) - update to 1.29.1-20.2.rhaos4.15.el9
conmon (Red Hat package) - update to 2.1.7-1.2.rhaos4.14.el9
SANnav - addressed in versions 2.3.0a, 2.3.1
ignition (Red Hat package) - update to 2.16.2-2.rhaos4.15.el9
container-selinux (Red Hat package) - addressed in versions 2.226.0-1.rhaos4.14.el8, 2.226.0-1.rhaos4.14.el9, 2.228.1-1.rhaos4.15.el9
APEX Cloud Platform Foundation Software - update to 03.00.04.01
APEX Cloud Platform for Red Hat OpenShift - addressed in versions 03.01.02.00, 4.13.39
PowerStore X - update to 3.2.1.4-2386214
PowerStore T - update to 4.0.0.2-2365061
libslirp-devel - update to 4.4.0-1
libslirp - update to 4.4.0-1
IBM Cloud Pak for Watson AIOps - update to 4.4.1
podman (Red Hat package) - update to 4.4.1-21.rhaos4.15.el9
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.4
DB2 on Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
openshift-clients (Red Hat package) - addressed in versions 4.11.0-202401122348.p0.gbf40a6c.assembly.stream.el8, 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9
Red Hat OpenShift on IBM Cloud - addressed in versions 4.11.58 1591, 4.12.49 1578, 4.13.32 1557, 4.14.11 1547
openshift (Red Hat package) - addressed in versions 4.14.0-202401231033.p0.g28ed2d7.assembly.stream.el8, 4.14.0-202401231033.p0.g28ed2d7.assembly.stream.el9, 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.14.0-202401261353.p0.g607e2dd.assembly.stream.el8, 4.14.0-202401261353.p0.g607e2dd.assembly.stream.el9, 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9
Red Hat build of MicroShift - addressed in versions 4.14.42, 4.15, 4.17.7
microshift (Red Hat package) - addressed in versions 4.14.42-202411280904.p0.gcf4d04f.assembly.4.14.42.el9, 4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9, 4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9
openshift-ansible (Red Hat package) - update to 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9
kernel (Red Hat package) - addressed in versions 4.18.0-372.89.1.el8_6, 4.18.0-372.91.1.el8_6, 5.14.0-284.50.1.el9_2, 5.14.0-284.54.1.el9_2
kernel-rt (Red Hat package) - addressed in versions 4.18.0-372.89.1.rt7.249.el8_6, 4.18.0-372.91.1.rt7.251.el8_6, 5.14.0-284.50.1.rt14.335.el9_2, 5.14.0-284.54.1.rt14.339.el9_2
rust-afterburn (Red Hat package) - update to 5.4.3-2.rhaos4.15.el9
IBM MQ Operator - addressed in versions 9.3.0.20-r2, 9.4.0.0-r3
openstack-ironic-python-agent (Red Hat package) - update to 9.6.1-0.20240103100525.3197b9d.el9
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
Dell EMC NetWorker vProxy - addressed in versions 19.9.0.6, 19.10.0.2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.19, 23.0.19
cockpit-podman - update to 46-1
Chrome OS - update to 120.0.6099.310
ostree (Red Hat package) - update to 2023.8-3.el9
rpm-ostree (Red Hat package) - update to 2024.2-1.el9

• Exploit #9727 - CVE-2024-21626-demo (April 19, 2024)
• Exploit #9667 - CVE-2024-21626 (April 5, 2024)
• Exploit #9542 - runc (docker) File Descriptor Leak Privilege Escalation (February 5, 2024)

• https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv
• https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf
• https://github.com/opencontainers/runc/releases/tag/v1.1.12

• Security restrictions bypass in runc
• Multiple vulnerabilities in containerd
• Ubuntu update for runc
• Amazon Linux AMI update for runc
• SUSE update for runc
• SUSE update for runc
• Fedora 39 update for runc
• Fedora 38 update for runc
• Multiple vulnerabilities in BuildKit
• Multiple vulnerabilities in Moby
• Red Hat Enterprise Linux 9 update for runc
• SUSE update for runc
• Red Hat Enterprise Linux 7 Extras update for runc
• Multiple vulnerabilities in HashiCorp Nomad
• Red Hat Enterprise Linux 9.0 Extended Update Support update for runc
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 8.6 Extended Update Support update for the container-tools:4.0 module
• Red Hat Enterprise Linux 8 update for the container-tools:2.0 module
• Red Hat Enterprise Linux 8.8 Extended Update Support update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 8 update for the container-tools:3.0 module
• OpenShift Container Platform 4.13 update for runc
• OpenShift Container Platform 4.14 update for runc
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.11
• Red Hat Enterprise Linux 8.6 Extended Update Support update for the container-tools:rhel8 module
• OpenShift Container Platform 4.12 update for runc
• Red Hat Enterprise Linux 8 update for the container-tools:4.0 module
• Red Hat Enterprise Linux 9.2 Extended Update Support update for runc
• OpenShift Container Platform 4.11 update for runc
• SUSE update for runc
• crun update for runc
• Multiple vulnerabilities in OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Red Hat Enterprise Linux 7 Extras update for docker
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in Intel In-Band Manageability
• Security features bypass in Red Hat OpenShift on IBM Cloud
• openEuler update for runc
• Security features bypass in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Function Cloud Native Environment
• Multiple vulnerabilities in Google ChromeOS
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Security features bypass in Dell NetWorker vProxy
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Debian update for runc
• Multiple vulnerabilities in Dell APEX Cloud Platform for Red Hat OpenShift and Dell APEX Cloud Platform Foundation Software
• Amazon Linux AMI update for runc
• Gentoo update for runc
• Multiple vulnerabilities in IBM MQ Operator
• Fedora 39 update for podman-tui
• Fedora 40 update for podman-tui
• Fedora 41 update for podman-tui
• Fedora EPEL 9 update for podman-tui
• Fedora 41 update for prometheus-podman-exporter
• Fedora 39 update for prometheus-podman-exporter
• Fedora 40 update for prometheus-podman-exporter
• Fedora EPEL 9 update for prometheus-podman-exporter
• Multiple vulnerabilities in Dell PowerStore X
• Security features bypass in Red Hat build of MicroShift 4.17.7 packages
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Security features bypass in Red Hat build of MicroShift 4.14 packages
• Security features bypass in Red Hat build of MicroShift 4.15 packages
• Multiple vulnerabilities in Dell PowerStore T Family
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Anolis OS update for container-tools:4.0 module
• Anolis OS update for container-tools:an8 module
• Anolis OS update for runc
• Anolis OS update for runc
• Anolis OS update for docker
• Dell SmartFabric Storage Software update for third-party components
• Multiple vulnerabilities in Dell SANnav
• Multiple vulnerabilities in Dell APEX Cloud Platform for Red Hat OpenShift
• Multiple vulnerabilities in IBM Guardium Data Security Center
• IBM watsonx.data update for runc