cyber.hendryadrian.com
Vulnerability & Exploit · wiz.io

Leaky Vessels Flaws Enable Container Escape in runC and BuildKit

· Original article ↗

Summary

Four runC and BuildKit flaws could enable host access or container escape through crafted images, Dockerfiles, or build steps. The article details affected versions, exploitation risks, patches, and prioritization advice.

Key points

  • CVE-2024-21626 affects runC versions before 1.1.12; leaked file descriptors can expose the host filesystem and may enable container escape.
  • CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653 affect BuildKit versions before 0.12.5, with risks involving malicious build steps, Dockerfiles, or elevated-privilege container execution.
  • Exploitation generally requires control of a container image, Dockerfile, BuildKit frontend, or launch arguments, or a victim executing into a vulnerable container.
  • Potentially higher-risk environments include container-as-a-service offerings, build pipelines with anonymous access, and hosts running externally sourced images.
  • Wiz reports that at least 80% of cloud environments have instances vulnerable to CVE-2024-21626.
  • Patches are available in runC 1.1.12, BuildKit 0.12.5, Moby 25.0.2, and Docker Desktop 4.27.1; the article also recommends prioritizing container hosts and using trusted images and build sources.
  • Wiz says its Runtime Sensor can detect live CVE-2024-21626 exploitation attempts starting with sensor binary v1.0.3491 and definitions v1.0.848.

Article Details

Vulnerability Types
  • Container escape via leaked file descriptors and host filesystem access
  • Race condition in concurrent BuildKit build steps
  • Improper cleanup of mountpoint files allowing removal of host files
  • BuildKit API privilege escalation
Affected Versions
  • runC versions before 1.1.12
  • BuildKit versions before 0.12.5
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Use only container images from trusted sources and build only from trusted Dockerfiles.
  • Avoid using BuildKit frontends from untrusted sources.
  • Harden image registries and build pipelines against anonymous write access.

MITRE ATT&CK

T1098 · Account ManipulationThe article says successful exploitation may let an attacker obtain highly privileged credentials from a build pipeline.T1611 · Escape to HostThe vulnerabilities can allow a process in a container to escape to the underlying host filesystem or host operating system.

CVE

CVE-2024-21626New vulnerabilities have been revealed in the runC command line tool (CVE-2024-21626) and in BuildKit (CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653). These flaws pose a risk of container escape, meaning thatCVE-2024-23651New vulnerabilities have been revealed in the runC command line tool (CVE-2024-21626) and in BuildKit (CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653). These flaws pose a risk of container escape, meaning thatCVE-2024-23652have been revealed in the runC command line tool (CVE-2024-21626) and in BuildKit (CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653). These flaws pose a risk of container escape, meaning that exploiting them couldCVE-2024-23653in the runC command line tool (CVE-2024-21626) and in BuildKit (CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653). These flaws pose a risk of container escape, meaning that exploiting them could grant unauthorized

Vendors

Amazon Web ServicesLinux distributions have published an advisory for CVE-2024-21626: Debian, Ubuntu, Red Hat, openSUSE, AWS Linux and Alpine. GCPGCP also released an advisory on January 31, 2024, according to which GKE is impacted by CVE-2024-21626, and they will release a patch once one is ready (as of February 5, 2023, a patch remains unavailable). Microsoft AzureAzure has yet to publish an advisory on this subject as of February 5, 2023.  WizWiz customers can use Wiz to detect any vulnerable instances in their cloud environment and leverage the Wiz Security Graph to prioritize their remediation efforts. Wiz Runtime Sensor users can use the sensor to detect

Products

BuildKitNew vulnerabilities have been revealed in the runC command line tool (CVE-2024-21626) and in BuildKit (CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653). These flaws pose a risk of container escape, meaning thatDockerIt’s important to note that this vulnerability is also exploitable in higher-level runtimes like Docker or Kubernetes, either by running a specially crafted malicious container image (without additional configuration)Docker DesktopAll four vulnerabilities have been patched in Moby (Docker Engine) v25.0.2 and Docker Desktop v4.27.1.Kubernetessystem, potentially compromising sensitive data and facilitating lateral movement in the larger Kubernetes or cloud environment. MobyAll four vulnerabilities have been patched in Moby (Docker Engine) v25.0.2 and Docker Desktop v4.27.1.runCNew vulnerabilities have been revealed in the runC command line tool (CVE-2024-21626) and in BuildKit (CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653). These flaws pose a risk of container escape, meaning thatWiz Runtime Sensorcloud environment and leverage the Wiz Security Graph to prioritize their remediation efforts. Wiz Runtime Sensor users can use the sensor to detect live exploitation attempts and additional related malicious

Related Articles