CVE-2024-21626

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 8.6EPSS 19%

Published 2024-01-31Updated 2025-05-15

Media 7482PoC

Vulnerability details

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CNAGitHub_M

EPSS score history

Sources

4 links

PoC links are not available for guest users. Login to view them.

CVEShield The Hacker News Wiz Blog CVE Organization

Profile

CVSS

8.6

EPSS

19%

Published

2024-01-31

Updated

2025-05-15

CNA

GitHub_M

Vendors

opencontainers

1 product

CPEs

cpe:/a:redhat:rhel_extras_other:7

cpe:/a:redhat:ocp_tools:4.15::el8

cpe:/a:redhat:openshift:4.11::el8

cpe:/a:redhat:openshift:4.12::el8

cpe:/a:redhat:openshift:4.13::el8

cpe:/a:redhat:openshift:4.14::el8

cpe:/a:redhat:openshift:4.15::el8

cpe:/a:redhat:openshift:4.13::el9

cpe:/a:redhat:openshift:4.14::el9

cpe:/a:redhat:openshift:4.15::el9

cpe:/a:redhat:openshift:4.16::el9

cpe:/a:redhat:openshift:4.17::el9

cpe:/a:redhat:rhel_aus:8.2::appstream

cpe:/a:redhat:rhel_e4s:8.2::appstream

cpe:/a:redhat:rhel_tus:8.2::appstream

cpe:/a:redhat:rhel_aus:8.4::appstream

cpe:/a:redhat:rhel_e4s:8.4::appstream

cpe:/a:redhat:rhel_tus:8.4::appstream

cpe:/a:redhat:rhel_eus:8.6::appstream

cpe:/a:redhat:rhel_eus:8.8::appstream

cpe:/a:redhat:enterprise_linux:8::appstream

cpe:/a:redhat:rhel_eus:9.0::appstream

cpe:/a:redhat:rhel_eus:9.2::appstream

cpe:/a:redhat:enterprise_linux:9::appstream

cpe:/a:redhat:ocp_tools

cpe:/a:redhat:openshift_power_monitoring

cpe:/a:redhat:openshift:4

cpe:/a:redhat:container_native_virtualization:4

cpe:/a:redhat:quay:3

cpe:/a:redhat:openshift:4.12::el9

cpe:/a:redhat:openshift_ironic:4.14::el9

cpe:/o:redhat:enterprise_linux:10

cpe:/o:redhat:enterprise_linux:9

cpe:/o:redhat:rhivos:1

cpe:/a:redhat:enterprise_linux:8

cpe:/a:redhat:rhel_aus:8.2

cpe:/a:redhat:rhel_tus:8.2

cpe:/a:redhat:rhel_e4s:8.2

cpe:/a:redhat:rhel_aus:8.4

cpe:/a:redhat:rhel_tus:8.4

cpe:/a:redhat:rhel_e4s:8.4

cpe:/a:redhat:rhel_eus:8.6

cpe:/a:redhat:rhel_eus:8.8

cpe:/a:redhat:enterprise_linux:9

cpe:/a:redhat:rhel_eus:9.0

cpe:/a:redhat:rhel_eus:9.2

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated