CVE-2024-21626highobserved exploitationCWE-200CWE-403CWE-668

CVE-2024-21626: high-severity vulnerability in opencontainers runc

runc container breakout through process.cwd trickery and leaked fds

Published · Updated

Follow this CVE+ Monitor runc+ Monitor runc

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

83Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.6epss 19%
from disclosure to weapon1 day
Published on NVDJan 31
1st PoC+1d
metasploitJan 31
VulnCheck+97d
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
opencontainers · runc
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — opencontainers runc

In the same product, most dangerous first.

CVE-2021-43784MEDIUMOverflow in netlink bytemsg length field allows attacker to override netlink-based container configurationEPSS 1.8%CVE-2025-31133HIGHrunc container escape via "masked path" abuse due to mount race conditionsEPSS 1.2%CVE-2025-52565HIGHcontainer escape due to /dev/console mount and related racesEPSS 0.8%CVE-2025-52881HIGHrunc: LSM labels can be bypassed with malicious config using dummy procfs filesEPSS 0.8%CVE-2022-29162MEDIUMIncorrect Default Permissions in runcEPSS 0.4%CVE-2023-28642MEDIUMAppArmor bypass with symlinked /proc in runcEPSS 0.3%