CVE-2024-21626-POC

Usage Instructions

For educational/research purposes only. Any behavior not related to education/research is at your own risk.

Usage

docker build . -t cve-2024-21626
docker run -it --rm cve-2024-21626 bash /poc.sh
# Start another terminal
/bin/bash.copy

Note

Different docker/runc versions use different file descriptors. For example, with docker server:20.10.17 && runc version 1.1.2, use /proc/self/fd/9. The actual fd may change depending on the file opening order. The official documentation indicates that in most cases, /proc/self/fd/7 should be used.

Modification: Modify WORKDIR in Dockerfile to the corresponding value.

Prerequisites

The following conditions must be met simultaneously:

1. Ability to create a container and specify a command to execute
2. Ability to specify the image used by the container

Vulnerability Principle

TODO

References

https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv

https://github.com/opencontainers/runc/commit/2a4ed3e75b9e80d93d1836a9c4c1ebfa2b78870e