Priority reviewHigh

CVE-2024-21626

opencontainers runc, OCP-Tools-4.15-RHEL-8, Red Hat Enterprise Linux 7 Extras

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to ove...

CVSS: 8.6
EPSS: 18.1%
CISA KEV: Not listed
Published: 2024.02.01

PRIORITY ASSESSMENT

Priority review

FIRST EPSS indicates an elevated probability of exploitation.

Known exploitationNot established by KEV

Exploit probability18.1%

Technical severityCVSS 8.6

Vulnerability overview

Affected product and versions

Product: opencontainers runc, OCP-Tools-4.15-RHEL-8, Red Hat Enterprise Linux 7 Extras
Affected versions: >= >=v1.0.0-rc93, < 1.1.12, 39
Fixed versions: 1.1.12

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that opencontainers runc, OCP-Tools-4.15-RHEL-8, Red Hat Enterprise Linux 7 Extras and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE: CWE-200, CWE-403, CWE-668