CVE-2024-21626
Aliases:GHSA-xr7r-f8xq-vfvvGO-2024-2491RHEA-2024:6124RHSA-2024:0645RHSA-2024:0662RHSA-2024:0666RHSA-2024:0670RHSA-2024:0684RHSA-2024:0717RHSA-2024:0752RHSA-2024:0755RHSA-2024:0756RHSA-2024:0757RHSA-2024:0758RHSA-2024:0759RHSA-2024:0760RHSA-2024:0764RHSA-2024:10149RHSA-2024:10520RHSA-2024:10525RHSA-2024:10841RHSA-2024:1270DEBIAN-CVE-2024-21626CGA-2266-gfwq-4qhgCGA-24pc-8mwq-r5x3CGA-266r-82qx-rp4rCGA-289p-c6c6-wxw8CGA-28rh-p78m-9xg4CGA-2cgp-49wg-72mfCGA-2h7v-wm65-74j2CGA-33qr-mcvw-5r2xCGA-3fcf-7wfp-qxmpCGA-3j8x-p9jv-rgfvCGA-3m9r-77vv-x2x5CGA-3mxj-pgfp-2w74CGA-3vxw-pqx2-xm3rCGA-46m7-6hfq-7frrCGA-4ff7-8g78-4ffrCGA-4j8v-87hx-px7xCGA-4q2w-w38g-88rgCGA-58jx-6934-p965CGA-5hj9-3r9c-c47hCGA-5r4m-pq7f-q93jCGA-5rhp-vf5x-xvx4CGA-5rm6-8wxg-gw9hCGA-5v8r-jr5r-j833CGA-6277-w7jv-jvpcCGA-686j-crp5-cw5mCGA-68r2-9x8h-3mfqCGA-6f35-g87j-vwpgCGA-6hqg-rp4g-w5p4CGA-6phg-7c86-p8hcCGA-6vxr-vj6w-fvpvCGA-6x7g-79wh-r9mvCGA-7564-rwrp-pcpmCGA-78gc-27xv-hxm8CGA-7c8p-h3vj-5m2mCGA-7mwr-qj2g-hgrgCGA-7vgh-93hr-wccwCGA-88m5-6qph-rrv8CGA-8pqp-mp9g-mvh8CGA-8qcr-pj6f-x246CGA-8rvj-q853-qp55CGA-9224-g7w6-p9mxCGA-959x-cq9v-875pCGA-98vj-9p45-vf2vCGA-9c9j-96r5-q7wqCGA-9rqv-p2x4-hp2fCGA-c3fr-fvhh-24h7CGA-c4cm-m882-qgm8CGA-c4p7-r2h5-rfv8CGA-cwcc-j277-g286CGA-f2wx-gc3w-w3fpCGA-f97p-4hqv-mcxpCGA-f9r9-4c37-7cvxCGA-fgqh-7wp3-qjqhCGA-fhhx-4857-h9wwCGA-fw3w-wc66-j7hrCGA-fw73-6vq2-3x46CGA-g3x6-2fjj-3vcpCGA-g4rc-2vm2-hv84CGA-gh8f-6592-r6v9CGA-gj2p-qpvr-55m3CGA-gj6w-9c5w-6797CGA-gj9h-m242-j6gwCGA-h2cc-xqqf-2vvwCGA-h3f4-fpg2-286gCGA-h472-5rpf-6gm4CGA-h4hh-f6c6-88q7CGA-hhmc-8v2r-qv4rCGA-hmgc-g4xc-x5mcCGA-j5gj-hf85-rmhwCGA-j5hc-w5ch-2rhqCGA-j62p-rh9j-6v24CGA-jhh7-x5wh-43jhCGA-jhjx-jp7c-68chCGA-jjmp-93r6-274hCGA-jqp3-qmp5-x2jxCGA-jrg4-r66r-rm5xCGA-jwv7-9j53-rr83CGA-m2qc-4jwx-xm5cCGA-m559-ff6p-w9gvCGA-m5gv-qmhj-wg82CGA-m723-qjh2-3pgjCGA-m7ph-69v2-cf42CGA-m96h-354w-w3x8CGA-mmxr-6w63-qpxmCGA-mq68-47pf-v2m4CGA-mqjp-5fmc-8xpwCGA-mrgc-8cfv-rg5gCGA-p34p-w76f-g7p3CGA-p375-h9pw-4qmhCGA-p9jx-5qr6-wvq8CGA-pcxh-j7wr-5hgqCGA-pj26-hqvp-7gj3CGA-pjgc-7vxq-7358CGA-pjq5-5jq3-qmxwCGA-q2p7-5jvq-49c3CGA-q3w4-xwqg-475cCGA-q4pg-grc3-8q34CGA-q6rc-x469-r2x8CGA-q9gg-qm2w-722qCGA-qmgc-gj66-g3qcCGA-qq5r-4v25-4c56CGA-qw34-mmxq-pmqhCGA-qx75-82w6-h42hCGA-r965-g7fj-786mCGA-rqm4-gj5h-86rqCGA-rv4f-q37f-x94gCGA-rvx6-x43w-hr8wCGA-rx6v-9pwj-q723CGA-v7wc-h7wj-rxwmCGA-vcrp-px2q-5gjqCGA-vfmf-5wpx-w4m3CGA-vg66-w48x-g62fCGA-vpc2-rjj6-jx65CGA-w9mx-9fw7-pq34CGA-w9pp-x6rp-68xjCGA-wh6h-gwg7-wg3xCGA-wjjw-7x2m-w5pqCGA-wmvc-jq5r-8p7rCGA-xcmv-hwm6-cmccCGA-xfj7-9vj9-22gvCGA-xfp5-2fj6-qr9cCGA-xj2h-hfq5-69gfCGA-xrc8-jh4j-8r5fCGA-xv6m-24gv-46vxCGA-xvw6-rw5j-74pjCGA-xw8w-6ggr-rjwr
Advisory lineage Upstream: 0 Downstream: 34
Modified
Published: 31 Jan 2024, 21:31
Last modified:17 Sept 2026, 12:04
Vulnerability Summary
Overall Risk (default)
medium
48/100 CVSS Score
8.6 HIGH
v3.1 (cve.org)
EPSS Score
18.09% MEDIUM
18% probability +13.53%
KEV
Not listed
Ransomware
No reports
Public exploits
3 found
Dark Web
Not detected
Timeline
31 Jan 2024, 21:31
Published
Vulnerability first disclosed
17 Sept 2026, 12:04
Last Modified
Vulnerability information updated
Description
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
CVSS Metrics
- v3.1•HIGH•Score: 8.6CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Trends
Current EPSS score: 18.09%• Percentile: 97%
Techniques & Countermeasures
- CWE-403•Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.
- CWE-668•Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
- CWE-200•Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected Systems
- chainguard•buildkitd
< 0.12.5-r1
- chainguard•cadvisor
< 0.48.1-r4
- chainguard•ctop
< 0.7.7-r13
- chainguard•docker
< 25.0.2-r0
- chainguard•docker-config-mirror-gcr
< 25.0.2-r0
- chainguard•docker-dind
< 25.0.2-r0
- chainguard•docker-init
< 25.0.2-r0
- chainguard•docker-oci-entrypoint
< 25.0.2-r0
- chainguard•dockerd
< 25.0.2-r0
- chainguard•dockerd-oci-entrypoint
< 25.0.2-r0
- chainguard•dockerd-service
< 25.0.2-r0
- chainguard•grype
< 0.74.4-r1
- chainguard•k3d
< 5.6.0-r6
- chainguard•k3d-proxy
< 5.6.0-r6
- chainguard•k3d-tools
< 5.6.0-r6
- chainguard•k3s
< 1.29.0-r1
- chainguard•k3s-multicall
< 1.29.0-r1
- chainguard•k3s-static
< 1.29.0-r1
- chainguard•k9s
< 0.31.8-r0
- chainguard•kaniko
< 1.20.1-r0
- chainguard•kaniko-compat
< 1.20.1-r0
- chainguard•kaniko-warmer
< 1.20.1-r0
- chainguard•kaniko-warmer-compat
< 1.20.1-r0
- chainguard•kots
< 1.107.0-r1
- chainguard•kots-compat
< 1.107.0-r1
- chainguard•kots-symlink-compat
< 1.107.0-r1
- chainguard•kubectl-1.25
all
- chainguard•kubectl-1.25-default
all
- chainguard•kubectl-1.26
all
- chainguard•kubectl-1.26-default
all
- chainguard•kubectl-1.27
all
- chainguard•kubectl-1.27-default
all | < 1.27.11-r1
- chainguard•kubectl-1.28
all | < 1.28.9-r0
- chainguard•kubectl-1.28-default
< 1.28.9-r0 | all | < 1.28.7-r1
- chainguard•kubectl-1.29
< 1.29.3-r1
- chainguard•kubectl-1.29-default
< 1.29.3-r1
- chainguard•kubectl-bash-completion-1.25
all
- chainguard•kubectl-bash-completion-1.26
all
- chainguard•kubectl-bash-completion-1.27
all
- chainguard•kubectl-bash-completion-1.28
all | < 1.28.9-r0
- chainguard•kubectl-bash-completion-1.29
< 1.29.3-r1
- chainguard•kubescape
< 3.0.3-r7
- chainguard•nerdctl
< 1.7.3-r0
- chainguard•newrelic-infrastructure-agent
< 1.48.4-r1
- chainguard•podman
< 5.2.2-r1
- chainguard•podman-doc
< 5.2.2-r1
- chainguard•runc
< 1.1.12-r0
- chainguard•skaffold
< 2.11.0-r0
- chainguard•skopeo
< 1.14.2-r1
- chainguard•syft
< 0.104.0-r0
Showing first 50 affected entries in server-rendered view.
References (80)
- https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv
- https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf
- https://github.com/opencontainers/runc/releases/tag/v1.1.12
- http://www.openwall.com/lists/oss-security/2024/02/01/1
- http://www.openwall.com/lists/oss-security/2024/02/02/3
- http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J/
- https://lists.debian.org/debian-lts-announce/2024/02/msg00005.html
- https://www.vicarius.io/vsociety/posts/leaky-vessels-part-1-cve-2024-21626
- https://nvd.nist.gov/vuln/detail/CVE-2024-21626
- https://github.com/opencontainers/runc
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL
- https://access.redhat.com/security/cve/CVE-2024-21626
- https://bugzilla.redhat.com/show_bug.cgi?id=2258725
- https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21626.json
- https://access.redhat.com/errata/RHSA-2024:1270
- https://access.redhat.com/errata/RHSA-2024:0717
- https://access.redhat.com/errata/RHSA-2024:4597
- https://access.redhat.com/errata/RHSA-2024:0684
- https://access.redhat.com/errata/RHSA-2025:2441
- https://access.redhat.com/errata/RHSA-2024:0666
- https://access.redhat.com/errata/RHSA-2025:2701
- https://access.redhat.com/errata/RHSA-2024:0662
- https://access.redhat.com/errata/RHSA-2025:2710
- https://access.redhat.com/errata/RHSA-2024:0645
- https://access.redhat.com/errata/RHSA-2025:1711
- https://access.redhat.com/errata/RHSA-2024:10525
- https://access.redhat.com/errata/RHSA-2024:10841
- https://access.redhat.com/errata/RHSA-2024:10149
- https://access.redhat.com/errata/RHSA-2025:0650
- https://access.redhat.com/errata/RHSA-2024:10520
- https://access.redhat.com/errata/RHSA-2025:0115
- https://access.redhat.com/errata/RHSA-2024:0758
- https://access.redhat.com/errata/RHSA-2024:0760
- https://access.redhat.com/errata/RHSA-2024:0757
- https://access.redhat.com/errata/RHSA-2024:0764
- https://access.redhat.com/errata/RHSA-2024:0759
- https://access.redhat.com/errata/RHSA-2024:0748
- https://access.redhat.com/errata/RHSA-2024:0752
- https://access.redhat.com/errata/RHSA-2024:0756
- https://access.redhat.com/errata/RHSA-2024:0755
- https://access.redhat.com/errata/RHSA-2024:0670
- https://access.redhat.com/errata/RHEA-2024:6124
- https://access.redhat.com/security/vulnerabilities/RHSB-2024-001
- https://issues.redhat.com/browse/OCPBUGS-38848
- https://issues.redhat.com/browse/OCPBUGS-38974
- https://issues.redhat.com/browse/OCPBUGS-39260
- https://issues.redhat.com/browse/OCPBUGS-41510
- https://issues.redhat.com/browse/OCPBUGS-45973
- https://issues.redhat.com/browse/OCPBUGS-47463
- https://issues.redhat.com/browse/OCPBUGS-48577
- https://issues.redhat.com/browse/OCPBUGS-49417
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhea-2024_6124.json
- https://www.cve.org/CVERecord?id=CVE-2024-21626
- https://access.redhat.com/security/updates/classification/#moderate
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0645.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0662.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0666.json
- https://access.redhat.com/security/updates/classification/#important
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0670.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0684.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0717.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0752.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0755.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0756.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0757.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0758.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0759.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0760.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0764.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10149.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10520.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10525.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10841.json
- https://access.redhat.com/security/vulnerabilities/CVE-2024-21626
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1270.json
- https://security-tracker.debian.org/tracker/CVE-2024-21626
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21626.json