CVE-2024-21626

What it actually does

Internal file descriptor leak in runc allows a newly-spawned container process (via runc exec or run) to obtain a working directory in the host filesystem namespace, granting direct access to host files and enabling semi-arbitrary host binary overwrites for full escape.

Why it matters to the business

Successful exploitation breaks container isolation on Linux hosts, risking full host compromise, lateral movement to other containers, and data exfiltration. Weaponized public exploits combined with a rising EPSS score increase urgency for organizations running container workloads at scale.

How an attack unfolds

An attacker supplies a malicious container image or issues a runc exec command; the leaked file descriptor causes the container process to inherit a host-namespace working directory. This enables reading or writing host files, with variants allowing overwrite of host binaries to achieve complete container escape.

How to fix it

Upgrade opencontainers/runc to version 1.1.12 or later, specifically commit 51d5e94601ceffbbd85688df1c928ecccbfa4685. Rebuild and redeploy all container images and orchestration configurations that depend on the patched runc binary.

How to confirm the fix worked

Verify the installed runc binary reports version 1.1.12 or contains commit 51d5e94601ceffbbd85688df1c928ecccbfa4685; run integration tests that attempt to access host paths from within a container to confirm isolation is restored.

Typical attack path

1. Craft or obtain a malicious OCI image or prepare a runc exec invocation targeting the vulnerable runc binary
2. Trigger container creation (runc run) or process execution (runc exec) on a host running runc 1.1.11 or earlier
3. Exploit the leaked file descriptor so the container process receives a working directory inside the host filesystem namespace
4. Use host filesystem access to read sensitive data or overwrite semi-arbitrary host binaries for persistent escape

How to detect it

Review runc process logs and container runtime audit events for unexpected working-directory paths that resolve outside container rootfs; correlate with exec or run operations and look for subsequent host-file access attempts by container PIDs.

• runc.*exec.*host filesystem
• working directory.*host namespace
• container escape via file descriptor leak

What your security team should do

• Immediately upgrade all runc installations to the fixed commit and rebuild dependent container images
• Scan container registries and CI/CD pipelines for images built with vulnerable runc versions
• Enable runtime monitoring for unexpected host filesystem access originating from container processes
• Review and tighten seccomp and AppArmor/SELinux policies around runc exec operations