runc container breakout through process.cwd trickery and leaked fds
Priority HIGH 72CWE-403Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 21 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.18923 97th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial runc (opencontainers): 1.1.12github.com/opencontainers/runc (Go): 1.1.12Red Hat: 27 advisoriesRed Hat: 21 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | runc | v1.0.0-rc93 to before 1.1.12 | 1.1.12 | Patch available | CNA |
| — | github.com/opencontainers/runc (Go) | 1.0.0-rc93 to before 1.1.12 | 1.1.12 | Patch available | GHSA-xr7r-f8xq-vfvv |
- runc Vendorbackstage Affected v1.0.0-rc93 to before 1.1.12 Fixed in 1.1.12 Patch available CNA
- github.com/opencontainers/runc (Go) Vendor— Affected 1.0.0-rc93 to before 1.1.12 Fixed in 1.1.12 Patch available GHSA-xr7r-f8xq-vfvv
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* | before 1.1.12 | Vulnerable | backstage |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
- cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions before 1.1.12 Vulnerable ·backstage
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA runc (opencontainers) Fixed in 1.1.12
- Fix · GHSA-xr7r-f8xq-vfvv github.com/opencontainers/runc (Go) Fixed in 1.1.12 Advisory →
Red Hat 27 advisories
- RHSA-2025:2701 Released 2025-03-20 · Red Hat rating ImportantOpenShift Container Platform 4.13.56 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-agent-installer-csr-approver-rhel8, openshift4/ose-agent-installer-node-agent-rhel8, openshift4/ose-agent-installer-orchestrator-rhel8 +3
- RHSA-2025:2710 Released 2025-03-19 · Red Hat rating ImportantOpenShift Container Platform 4.14.49 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-docker-builder, rhcos
- RHSA-2025:2441 Released 2025-03-13 · Red Hat rating ImportantOpenShift Container Platform 4.12.74 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-agent-installer-csr-approver-rhel8, openshift4/ose-agent-installer-orchestrator-rhel8, openshift4/ose-docker-builder +2
Show 24 more Red Hat advisories
- RHSA-2025:1711 Released 2025-02-27 · Red Hat rating ImportantOpenShift Container Platform 4.15.46 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-docker-builder, openshift4/ose-operator-marketplace-rhel9, rhcos
- RHSA-2025:0650 Released 2025-01-29 · Red Hat rating ImportantOpenShift Container Platform 4.16.32 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/ose-agent-installer-api-server-rhel9, openshift4/ose-baremetal-machine-controllers-rhel9, openshift4/ose-docker-builder-rhel9 +4
- RHSA-2025:0115 Released 2025-01-14 · Red Hat rating ImportantOpenShift Container Platform 4.17.12 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/ose-cloud-credential-rhel9-operator, openshift4/ose-console-rhel9, openshift4/ose-docker-builder-rhel9
- RHSA-2024:10841 Released 2024-12-12 · Red Hat rating ImportantOpenShift Container Platform 4.15.41 security update
- Red Hat OpenShift Container Platform 4.15 microshift-4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9, microshift-greenboot-4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9, microshift-networking-4.15.41-202412091343.p0.gcf9680e.assembly.4.15.41.el9 +4
- RHSA-2024:10525 Released 2024-12-05 · Red Hat rating ImportantRed Hat build of MicroShift 4.14.42 security update
- Red Hat OpenShift Container Platform 4.14 microshift-4.14.42-202411280904.p0.gcf4d04f.assembly.4.14.42.el9, microshift-greenboot-4.14.42-202411280904.p0.gcf4d04f.assembly.4.14.42.el9, microshift-networking-4.14.42-202411280904.p0.gcf4d04f.assembly.4.14.42.el9 +2
- RHSA-2024:10520 Released 2024-12-03 · Red Hat rating ImportantOpenShift Container Platform 4.17.7 security update
- Red Hat OpenShift Container Platform 4.17 microshift-4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9, microshift-greenboot-4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9, microshift-low-latency-4.17.7-202411280904.p0.g129334d.assembly.4.17.7.el9 +7
- RHSA-2024:10149 Released 2024-11-26 · Red Hat rating ImportantRed Hat build of MicroShift 4.16.24 security update
- Red Hat OpenShift Container Platform 4.16 microshift-4.16.24-202411220522.p0.gcc4fedc.assembly.4.16.24.el9, microshift-greenboot-4.16.24-202411220522.p0.gcc4fedc.assembly.4.16.24.el9, microshift-multus-4.16.24-202411220522.p0.gcc4fedc.assembly.4.16.24.el9 +6
- RHSA-2024:4597 Released 2024-07-17 · Red Hat rating ImportantRed Hat Product OCP Tools 4.15 OpenShift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.15 jenkins-2-plugins-4.15.1718879538-1.el8, jenkins-2.440.3.1718879390-3.el8
- RHSA-2024:1270 Released 2024-03-12 · Red Hat rating Importantdocker security update
- Red Hat Enterprise Linux 7 Extras docker-2:1.13.1-210.git7d71120.el7_9, docker-client-2:1.13.1-210.git7d71120.el7_9, docker-common-2:1.13.1-210.git7d71120.el7_9 +5
- RHSA-2024:0764 Released 2024-02-08 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) aardvark-dns-2:1.0.1-40.module+el8.6.0+21266+3e24c7b3.aarch64::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+21266+3e24c7b3.ppc64le::container-tools:rhel8, aardvark-dns-2:1.0.1-40.module+el8.6.0+21266+3e24c7b3.s390x::container-tools:rhel8 +47
- RHSA-2024:0666 Released 2024-02-08 · Red Hat rating ModerateOpenShift Container Platform 4.12.49 packages and security update
- Red Hat OpenShift Container Platform 4.12 runc-3:1.1.6-5.1.rhaos4.12.el8
- RHSA-2024:0684 Released 2024-02-08 · Red Hat rating ModerateOpenShift Container Platform 4.11.58 packages and security update
- Red Hat OpenShift Container Platform 4.11 runc-3:1.1.2-3.1.rhaos4.11.el8
- RHSA-2024:0757 Released 2024-02-08 · Red Hat rating Importantcontainer-tools:4.0 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) aardvark-dns-2:1.0.1-28.module+el8.6.0+21254+7ef668f8.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-28.module+el8.6.0+21254+7ef668f8.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-28.module+el8.6.0+21254+7ef668f8.s390x::container-tools:4.0 +47
- RHSA-2024:0759 Released 2024-02-08 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+21265+93802b02.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+21265+93802b02.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+21265+93802b02.s390x::container-tools:rhel8 +47
- RHSA-2024:0752 Released 2024-02-08 · Red Hat rating Importantcontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+21243+a586538b.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+21243+a586538b.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+21243+a586538b.s390x::container-tools:rhel8 +47
- RHSA-2024:0760 Released 2024-02-08 · Red Hat rating Importantcontainer-tools:3.0 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.src::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.x86_64::container-tools:3.0, buildah-tests-1.19.9-1.module+el8.4.0+21078+a96cfbf6.x86_64::container-tools:3.0 +40
- Red Hat Enterprise Linux AppStream E4S (v.8.4) buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.ppc64le::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.src::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.x86_64::container-tools:3.0 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.4) buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.src::container-tools:3.0, buildah-1.19.9-1.module+el8.4.0+21078+a96cfbf6.x86_64::container-tools:3.0, buildah-tests-1.19.9-1.module+el8.4.0+21078+a96cfbf6.x86_64::container-tools:3.0 +40
- RHSA-2024:0758 Released 2024-02-08 · Red Hat rating Importantcontainer-tools:2.0 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) buildah-1.11.6-8.module+el8.2.0+21264+96602818.src::container-tools:2.0, buildah-1.11.6-8.module+el8.2.0+21264+96602818.x86_64::container-tools:2.0, buildah-tests-1.11.6-8.module+el8.2.0+21264+96602818.x86_64::container-tools:2.0 +33
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) buildah-1.11.6-8.module+el8.2.0+21264+96602818.ppc64le::container-tools:2.0, buildah-1.11.6-8.module+el8.2.0+21264+96602818.src::container-tools:2.0, buildah-1.11.6-8.module+el8.2.0+21264+96602818.x86_64::container-tools:2.0 +47
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) buildah-1.11.6-8.module+el8.2.0+21264+96602818.src::container-tools:2.0, buildah-1.11.6-8.module+el8.2.0+21264+96602818.x86_64::container-tools:2.0, buildah-tests-1.11.6-8.module+el8.2.0+21264+96602818.x86_64::container-tools:2.0 +33
- RHSA-2024:0755 Released 2024-02-08 · Red Hat rating Importantrunc security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) runc-4:1.1.12-1.el9_2
- RHSA-2024:0748 Released 2024-02-08 · Red Hat rating Importantcontainer-tools:4.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.s390x::container-tools:4.0 +47
- RHSA-2024:0756 Released 2024-02-08 · Red Hat rating Importantrunc security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) runc-4:1.1.12-1.el9_0
- RHSA-2024:0645 Released 2024-02-07 · Red Hat rating ModerateOpenShift Container Platform 4.14.11 packages and security update
- Red Hat OpenShift Container Platform 4.14 runc-4:1.1.12-1.rhaos4.14.el8, runc-4:1.1.12-1.rhaos4.14.el9
- RHSA-2024:0662 Released 2024-02-07 · Red Hat rating ModerateOpenShift Container Platform 4.13.32 packages and security update
- Red Hat OpenShift Container Platform 4.13 runc-4:1.1.12-1.rhaos4.13.el8, runc-4:1.1.12-1.rhaos4.13.el9
- RHSA-2024:0717 Released 2024-02-07 · Red Hat rating Importantrunc security update
- Red Hat Enterprise Linux 7 Extras runc-1.0.0-70.rc10.el7_9
- RHSA-2024:0670 Released 2024-02-02 · Red Hat rating Importantrunc security update
- Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.12-1.el9_3
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix planned: Will not fix |
| Power monitoring for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| OpenShift Developer Tools and Services for OCP 4.15 | Fixed | RHSA-2024:4597 |
| Red Hat Enterprise Linux 7 Extras | Fixed | RHSA-2024:0717, RHSA-2024:1270 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0748, RHSA-2024:0752 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:0670 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2024:0758 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2024:0760 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2024:0758 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2024:0760 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2024:0757, RHSA-2024:0764 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:0759 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2024:0756 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:0755 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2024:0758 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2024:0760 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2024:0684 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:0666, RHSA-2025:2441 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:0662, RHSA-2025:2701 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:0645, RHSA-2024:10525, RHSA-2025:2710 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:10841, RHSA-2025:1711 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:10149, RHSA-2025:0650 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2024:10520, RHSA-2025:0115 |
Not affected: 11 products
- Ironic content for Red Hat OpenShift Container Platform 4.14
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
Timeline
- 2026-10-02 Threatist record created from CVE-2024-21626
- 2026-10-03 Alias added: GHSA-xr7r-f8xq-vfvv
References
Exploit 2
Other 40
- https://github.com/opencontainers/runc/releases/tag/v1.1.12
- http://www.openwall.com/lists/oss-security/2024/02/01/1
- http://www.openwall.com/lists/oss-security/2024/02/02/3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J/
- https://lists.debian.org/debian-lts-announce/2024/02/msg00005.html
- https://access.redhat.com/errata/RHSA-2024:0645
- https://access.redhat.com/errata/RHSA-2024:4597
- https://access.redhat.com/errata/RHSA-2025:0115
- https://access.redhat.com/errata/RHSA-2025:0650
- https://access.redhat.com/errata/RHSA-2025:1711
- https://access.redhat.com/errata/RHSA-2025:2441
- https://access.redhat.com/errata/RHSA-2025:2701
- https://access.redhat.com/errata/RHSA-2025:2710
- https://access.redhat.com/security/cve/CVE-2024-21626
- https://bugzilla.redhat.com/show_bug.cgi?id=2258725
- https://github.com/opencontainers/runc
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL
- https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21626.json
- https://www.vicarius.io/vsociety/posts/leaky-vessels-part-1-cve-2024-21626
- https://access.redhat.com/errata/RHSA-2024:0662
- https://access.redhat.com/errata/RHSA-2024:0666
- https://access.redhat.com/errata/RHSA-2024:0670
- https://access.redhat.com/errata/RHSA-2024:0684
- https://access.redhat.com/errata/RHSA-2024:0717
- https://access.redhat.com/errata/RHSA-2024:0748
- https://access.redhat.com/errata/RHSA-2024:0752
- https://access.redhat.com/errata/RHSA-2024:0755
- https://access.redhat.com/errata/RHSA-2024:0756
- https://access.redhat.com/errata/RHSA-2024:0757
- https://access.redhat.com/errata/RHSA-2024:0758
- https://access.redhat.com/errata/RHSA-2024:0759
- https://access.redhat.com/errata/RHSA-2024:0760
- https://access.redhat.com/errata/RHSA-2024:0764
- https://access.redhat.com/errata/RHSA-2024:10149
- https://access.redhat.com/errata/RHSA-2024:10520
- https://access.redhat.com/errata/RHSA-2024:10525
- https://access.redhat.com/errata/RHSA-2024:10841
- https://access.redhat.com/errata/RHSA-2024:1270
More backstage Runc vulnerabilities
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
- TI-2021-10869 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. CVSS 3.1HIGH 8.5
- TI-2019-12591 runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows… CVSS 3.1HIGH 7.5
- TI-2025-32660 container escape due to /dev/console mount and related races CVSS 4.0HIGH 8.4
- TI-2025-22394 runc container escape via "masked path" abuse due to mount race conditions CVSS 4.0HIGH 7.3
- TI-2025-32917 runc: LSM labels can be bypassed with malicious config using dummy procfs files CVSS 4.0HIGH 7.3
Sources
- CVE-2024-21626 · CVE Program
- CVE-2024-21626 · NVD
- FIRST EPSS
- GHSA-xr7r-f8xq-vfvv · GitHub Advisory Database · CC BY 4.0
- CVE-2024-21626 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences