VulnerabilityModified

CVE-2024-21626

In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving…

HIGH 8.6EPSS 18.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 18.9%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

CVSS 3.1: 8.6 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS: 18.92% probability · 97th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-403, CWE-668, CWE-200
Affected: linuxfoundation/runc · fedoraproject/fedora
Source: security-advisories@github.com

EPSS trend

EPSS 18.9% since 3 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.