Skip to content
OpenAdvisories

Weakness (CWE)

CWE-403: Exposure of File Descriptor to Unintended Control Sphere

Base Draft

A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

Source: MITRE CWE-403

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.6
    CVE-2024-21626 Public exploit EPSS 19%

    runc container breakout through process.cwd trickery and leaked fds

    runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a worki…

    opencontainers runc runc github.com/opencontainers/runc Debian Ubuntu Alpine Go