Vulnerability description

On January 31, 2024, runc officially issued a security advisory (https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv). In runc versions 1.1.11 and earlier, due to an internal file descriptor leakage issue, attackers could cause the working directory of newly spawned container processes to reside in the host filesystem namespace, enabling container escape and other malicious activities.

Exploiting this vulnerability requires specific conditions, such as allowing the attacker to deploy custom images. An official security update was released on February 1, 2024, and affected users are advised to upgrade promptly.

Scope of impact

1.0.0-rc93 <= runc <= 1.1.11

Security version

runc 1.1.12

Mitigation recommendations

1. The official security update (runc 1.1.12) was released on February 1, 2024, and affected users are advised to upgrade. https://github.com/opencontainers/runc/releases/tag/v1.1.12
2. Impact and remediation progress of Baidu AI Cloud CCE container service

• New CCE clusters and nodes created on or after February 19, 2024, are not impacted by this vulnerability.
• For existing nodes in clusters, runc can be upgraded by executing the following command on the machine:

1wget https://baidu-container.cdn.bcebos.com/runtime/containerd/cce-cve-2024-21626.tar.gz && tar -zxf cce-cve-2024-21626.tar.gz && cd cce-cve-2024-21626 && bash upgrade-runc-v1.1.12.sh

3. If upgrading to the fixed version is not possible, the official mitigation measures (evaluate business impact before implementation) are as follows:

• Set the container’s WORKDIR to /
• Only allow users to run trusted images
• Do not execute exec

Reference link:

https://github.com/opencontainers/runc/releases/tag/v1.1.12 https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv