CVE-2024-21626: 
cAdvisor 脆弱性分析と緩和策

CVE-2024-21626 affects runc, a CLI tool for spawning and running containers on Linux according to the OCI specification. The vulnerability was discovered in runc versions 1.1.11 and earlier, with a disclosure date of January 31, 2024. The issue stems from an internal file descriptor leak that could allow attackers to perform container escapes and gain unauthorized access to the host filesystem (GitHub Advisory, NVD).

The vulnerability has a CVSS v3.1 base score of 8.6 (High) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The core issue involves a file descriptor leak where, despite O_CLOEXEC being set on all file descriptors before executing container code, a file descriptor remains open during setcwd(2). This allows the reference to persist into the container through working directory configuration via file descriptor paths (GitHub Advisory).

The vulnerability enables multiple attack vectors: 1) A container process can gain access to the host filesystem through runc run, 2) A newly-spawned container process can access the host filesystem through runc exec, and 3) Variants of these attacks can be used to overwrite semi-arbitrary host binaries, leading to complete container escapes. The impact is particularly severe as it allows for full control of the host system (GitHub Advisory, Red Hat Security).

The vulnerability can be exploited through multiple methods: 1) Using malicious images to trick users into running containers with compromised configurations, 2) Exploiting runc exec operations from within a container, and 3) Leveraging path traversal to overwrite host binaries. The attacks can be executed with minimal user interaction, particularly in the case of runc exec operations (GitHub Advisory).

The vulnerability has been patched in runc version 1.1.12. The fix includes multiple security measures: 1) Verification that working directories are inside the container, 2) Closing all internal runc file descriptors before execve, 3) Fixing specific fd leaks by marking /sys/fs/cgroup as O_CLOEXEC, and 4) Marking all non-stdio files as O_CLOEXEC before executing runc init. For unpatched systems, a temporary workaround is to only permit containers and runc exec to use a process.cwd of / (GitHub Advisory, GitHub Release).

The vulnerability has prompted rapid responses from major Linux distributions and cloud providers. Red Hat has issued a security bulletin (RHSB-2024-001) classifying it as Important, and multiple distributions including Fedora and Debian have released security updates. The discovery has also led to broader industry discussions about container runtime security, with other runtime maintainers being advised to implement similar protections (Red Hat Security, Debian Advisory).