RunC Flaws Enable Container Escapes, Granting Attackers Host Access

Numerous security vulnerabilities have been disclosed in the runC command line device that could be exploited by risk actors to escape the bounds of the container and stage stick to-on attacks.

The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed Leaky Vessels by cybersecurity seller Snyk.

“These container escapes could enable an attacker to achieve unauthorized obtain to the underlying host running technique from within the container and probably allow obtain to delicate data (qualifications, consumer information, etc.), and start further attacks, especially when the accessibility received incorporates superuser privileges,” the organization mentioned in a report shared with The Hacker Information.

runC is a software for spawning and managing containers on Linux. It was at first developed as part of Docker and later spun out into a separate open-source library in 2015.

A brief description of every single of the flaws is down below –

• CVE-2024-21626 – WORKDIR: Get of operations container breakout
• CVE-2024-23651 – Mount Cache Race
• CVE-2024-23652 – Buildkit Establish-time Container Teardown Arbitrary Delete
• CVE-2024-23653 – Buildkit GRPC SecurityMode Privilege Test

The most serious of the flaws is CVE-2024-21626, which could final result in a container escape centered close to the `WORKDIR` command.

“This could happen by working a malicious picture or by building a container picture using a destructive Dockerfile or upstream image (i.e. when applying `FROM`),” Snyk mentioned.

There is no proof that any of the recently discovered shortcomings have been exploited in the wild to day. That mentioned, the issues have been tackled in runC version 1.1.12 unveiled nowadays.

“Mainly because these vulnerabilities have an effect on widely utilised lower-amount container motor factors and container make equipment, Snyk strongly endorses that end users examine for updates from any vendors furnishing their container runtime environments, together with Docker, Kubernetes suppliers, cloud container services, and open up source communities,” the company stated.

In February 2019, runC maintainers dealt with an additional significant-severity flaw (CVE-2019-5736, CVSS score: 8.6) that could be abused by an attacker to crack out of the container and receive root accessibility on the host.

Located this short article attention-grabbing? Observe us on Twitter  and LinkedIn to read through more exceptional content material we put up.

Some parts of this article are sourced from:
thehackernews.com