Full Report
Detect and mitigate “Leaky Vessels”, container escape vulnerabilities affecting runC and BuildKit. Learn how to prioritize patching and detect exploitation attempts in runtime.
Analysis Summary
# Vulnerability: Container Escape via Leaky File Descriptors in runC and BuildKit
## CVE Details
- CVE ID: CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, CVE-2024-23653
- CVSS Score: Not explicitly provided for all, but **CVE-2024-21626** is described as the "most significant flaw," suggesting High severity.
- CWE: Not explicitly listed, but related to Improper Input Validation/Path Traversal (CVE-2024-21626).
## Affected Systems
- **Products (CVE-2024-21626):** runC, Docker, Kubernetes (any orchestration utilizing runC).
- **Products (CVE-2024-23651, 23652, 23653):** BuildKit.
- **Versions:**
- runC: Versions up to **v1.1.11**.
- BuildKit: Versions up to **v0.12.4**.
- **Configurations:**
- Exploitation of CVE-2024-21626 is possible via mounting malicious container images or specifying custom `workdir` options during container startup/execution (`runc exec`, `runc run`).
- Exploitation of BuildKit flaws requires building a specially crafted malicious Dockerfile.
## Vulnerability Description
Multiple vulnerabilities, collectively referred to as "Leaky Vessels," allow for container escape, potentially granting an attacker access to the host operating system.
**CVE-2024-21626 (runC):** This critical flaw allows an attacker to exploit leaked file descriptors through manipulated working directories during `runc exec` or by running a malicious container image with `runc run`. This enables the container process to traverse to the host filesystem, read/write host files, and potentially overwrite host binaries, resulting in full container escape. This is particularly dangerous in multi-tenant Kubernetes clusters.
**CVE-2024-23651 (BuildKit):** A race condition when two malicious build steps share identical cache mounts allows files from the host system to become writable within the build container.
**CVE-2024-23652 (BuildKit):** A malicious Dockerfile using `RUN --mount` can trick the file cleanup mechanism, leading to the deletion of host system files outside the container.
**CVE-2024-23653 (BuildKit):** In BuildKit versions up to v0.12.4, interactive containers launched via privileged APIs (when `security.insecure` entitlement is active) can be instructed to run with elevated privileges against the build daemon.
## Exploitation
- **Status:** Exploitation status is not explicitly stated as "in the wild," but the high impact and widespread prevalence (80% of cloud environments affected by CVE-2024-21626 according to Wiz data) suggest a high likelihood of exploitation attempts.
- **Complexity:** Low complexity is implied for CVE-2024-21626 via methods like manipulating Dockerfiles using `/proc/self/fd/`.
- **Attack Vector:** Network, Adjacent (via malicious container deployment or build process).
## Impact
- **Confidentiality:** High (Unauthorized access to host filesystem and other tenants' data in multi-tenant environments).
- **Integrity:** High (Ability to overwrite host binaries or delete host files).
- **Availability:** Medium to High (Potential for service disruption or compromise leading to further lateral movement).
## Remediation
### Patches
- **runC (CVE-2024-21626):** Update runC to **v1.1.12** or later. Linux distributions are responsible for publishing patches to their respective packages.
- **BuildKit (CVE-2024-23651, 23652, 23653):** Update BuildKit to versions **after v0.12.4**.
### Workarounds
- Employ defense-in-depth strategies.
- Never rely on containerization as the sole security boundary, especially in multi-tenant environments (Refer to the PEACH framework).
- Limit the ability to run untrusted images or modify build pipelines.
## Detection
- **Indicators of Compromise:** Monitoring for symbolic link traversal attempts within container execution contexts, especially involving `/proc` or `/sys`.
- **Detection Methods and Tools:**
- Wiz customers can use the **Wiz Threat Center** pre-built query to search for vulnerable runtime instances.
- **Wiz Runtime Sensor** (binary v1.0.3491 and definitions v1.0.848 or newer) can detect live exploitation attempts of CVE-2024-21626 by focusing on core symbolic link traversal activity.
- Prioritize remediation for affected VMs hosting containers, especially those utilizing images from untrusted sources.
## References
- Snyk blog: snyk dot io/blog/leaky-vessels-docker-runc-container-breakout-vulnerabilities/
- Docker advisory: docker dot com/blog/docker-security-advisory-multiple-vulnerabilities-in-runc-buildkit-and-moby/
- runC advisory: github dot com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv
- AWS advisory: aws dot com/security/security-bulletins/AWS-2024-001/
- GCP advisory: cloud dot google dot com/anthos/clusters/docs/security-bulletins#gcp-2024-005-gke