8.6
High
CVE-2024-21626 runc is a CLI tool for spawning and running containers on Linux according to the OCI specification
Description
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| runc 1.0 | 1.0.0-rc93 → < 1.1.12 | 1.1.12 |
| Red Hat Enterprise Linux 7 Extras | Versions not published | |
| OpenShift Developer Tools and Services for OCP 4.15 | Versions not published | |
| Red Hat OpenShift Container Platform 4.11 | Versions not published | |
| Red Hat OpenShift Container Platform 4.12 4.12 | earliest → < 4.12.0-202503030130.p0.g7c2a284.assembly.stream.el8 | 4.12.0-202503030130.p0.g7c2a284.assembly.stream.el8 |
| Red Hat OpenShift Container Platform 4.13 4.13 | earliest → < 4.13.0-202503111300.p0.gb379980.assembly.stream.el8 | 4.13.0-202503111300.p0.gb379980.assembly.stream.el8 |
| Red Hat OpenShift Container Platform 4.14 | Versions not published | |
| Red Hat OpenShift Container Platform 4.15 | Versions not published | |
| Red Hat OpenShift Container Platform 4.16 4.16 | earliest → < 4.16.0-202501160405.p0.g300d9ad.assembly.stream.el9 | 4.16.0-202501160405.p0.g300d9ad.assembly.stream.el9 |
Show the 34 other branches Hide the 34 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4.17 4.17 | earliest → < 4.17.0-202501052337.p0.gbb33e13.assembly.stream.el9 | 4.17.0-202501052337.p0.gbb33e13.assembly.stream.el9 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Versions not published | |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Versions not published | |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Versions not published | |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Versions not published | |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Versions not published | |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| OpenShift Developer Tools and Services | Versions not published | |
| Power monitoring for Red Hat OpenShift | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Ironic content for Red Hat OpenShift Container Platform 4.14 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat In-Vehicle Operating System 1 | Versions not published | |
| OCP-Tools-4.15-RHEL-8 | Versions not published | |
| Red Hat Enterprise Linux 8 8090020240201111839 | earliest → < 8090020240201111839.d7b6f4b7 | 8090020240201111839.d7b6f4b7 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020240206120705.28 | earliest → < 8020020240206120705.28c38760 | 8020020240206120705.28c38760 |
| Red Hat Enterprise Linux 8.2 Telecommunications Update Service 8020020240206120705.28 | earliest → < 8020020240206120705.28c38760 | 8020020240206120705.28c38760 |
| Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions 8020020240206120705.28 | earliest → < 8020020240206120705.28c38760 | 8020020240206120705.28c38760 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020240207051234 | earliest → < 8040020240207051234.c0c392d5 | 8040020240207051234.c0c392d5 |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service 8040020240207051234 | earliest → < 8040020240207051234.c0c392d5 | 8040020240207051234.c0c392d5 |
| Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 8040020240207051234 | earliest → < 8040020240207051234.c0c392d5 | 8040020240207051234.c0c392d5 |
| Red Hat Enterprise Linux 8.6 Extended Update Support 8060020240206151655.3 | earliest → < 8060020240206151655.3b538bd8 | 8060020240206151655.3b538bd8 |
| Red Hat Enterprise Linux 8.8 Extended Update Support 8080020240206143933.0 | earliest → < 8080020240206143933.0f77c1b7 | 8080020240206143933.0f77c1b7 |
| Red Hat Enterprise Linux 9.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.2 Extended Update Support | Versions not published |
References
- github.com github.com
- github.com github.com
- github.com github.com
- www.openwall.com www.openwall.com
- www.openwall.com www.openwall.com
- packetstormsecurity.com packetstormsecurity.com
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
- lists.debian.org lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of runc
The 10 CVEs of runc →
CVE-2026-41579
runc is a CLI tool for spawning and running containers according to the OCI specification
3.3
Low
CVE-2025-52881
runc is a CLI tool for spawning and running containers according to the OCI specification
7.3
High
CVE-2025-52565
runc is a CLI tool for spawning and running containers according to the OCI specification
8.4
High
CVE-2025-31133
runc is a CLI tool for spawning and running containers according to the OCI specification
7.3
High