Skip to content
OpenAdvisories
High USN-6619-1 1 CVE

runc vulnerability

Published Jan 31, 2024 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Rory McNamara discovered that runC did not properly manage internal file
descriptor while managing containers. An attacker could possibly use this
issue to obtain sensitive information or bypass container restrictions.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS runc 1.1.7-0ubuntu1~20.04.2
Ubuntu · 22.04 LTS 22.04:LTS runc 1.1.7-0ubuntu1~22.04.2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS runc 1.1.4-0ubuntu1~18.04.2+esm1

Vulnerabilities 1

  • High 8.6
    CVE-2024-21626 Public exploit EPSS 19%

    runc container breakout through process.cwd trickery and leaked fds

    runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a worki…

    opencontainers runc zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2024-21626