CVE-2024-21626

CVSS 3.1 Score 8.6 of 10 (high)

Details

Published Jan 31, 2024
Updated: Feb 19, 2024
CWE ID 403
CWE ID 668

Summary

CVE-2024-21626 is a vulnerability in runc, a CLI tool for running containers on Linux. In versions 1.1.11 and earlier, there is an internal file descriptor leak that allows an attacker to exploit the container and gain access to the host filesystem. This vulnerability can be triggered through the "runc exec" command or by using a malicious image with the "runc run" command. Successful exploitation of this vulnerability can lead to a complete escape from the container and potentially overwrite important host binaries. The issue has been addressed in runc version 1.1.12, which includes patches to fix the vulnerability.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-21626 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options