RunC Flaw Exploits: Prevent Hackers From Gaining Host Access

Wajahat Raja

February 13, 2024 - TuxCare expert team

In recent developments, security researchers have unveiled a series of high-severity vulnerabilities, collectively named ‘Leaky Vessels,’ or the RunC flaw exploits impacting key container infrastructure components such as Docker and runC. These vulnerabilities, discovered by Snyk’s Security Labs team and responsibly disclosed to vendors in December 2023, pose a significant threat by potentially allowing attackers to breach containers accessing sensitive data and systems.

The RunC Flaw Exploits

Four vulnerabilities have been identified, with the most critical being CVE-2024-21626, a high-risk flaw in runC, a widely used CLI tool for running containers on Linux. By manipulating command order, attackers could exploit this vulnerability to escape the container, gaining unauthorized access to the host operating system.

Snyk’s investigation also revealed three additional high-severity flaws in Docker’s BuildKit component, responsible for cyber attacks on containerized environments:

CVE-2024-23651 – A race condition enabling container escapes from the BuildKit mount cache.
CVE-2024-23653 – A privilege check bypass in BuildKit’s gRPC server, allowing container breakouts.
CVE-2024-23652 – A flaw permitting arbitrary file deletion during container build teardown.

Though exploiting these container security vulnerabilities demands precision, the widespread use of the affected software makes them highly dangerous, as successful attacks could grant access to sensitive data or serve as a launching point for further compromises.

RunC Flaw Mitigation Strategies

To mitigate the runC flaw exploits associated with these vulnerabilities, organizations using container technologies are urged to update their systems promptly:

Docker has released updated versions of buildkit, moby, and runC.
Kubernetes and other orchestrators should update to use runC 1.1.12 or later.
Container build tools in CI/CD pipelines and on developer machines should be patched.

Snyk has also released open-source tools to assist in identifying potential RunC vulnerability exploitation attempts, including a runtime detector and a static analyzer tool for Dockerfiles. However, it is crucial to emphasize that these tools do not provide protection against attacks; updating to patched versions of container software remains imperative.

Advisory from Vendors

In an independent advisory, Docker clarified that these vulnerabilities can only be exploited if a user actively engages with malicious content by incorporating it into the build process or running a container from a rogue image. Docker highlighted potential RunC vulnerability impacts, including unauthorized access to the host filesystem, compromising the integrity of the build cache, and, in the case of CVE-2024-21626, a scenario that could lead to full container escape.

Major cloud service providers, including Amazon Web Services (AWS) and Google Cloud, have also issued alerts, urging customers to take appropriate action to secure their environments.

No Evidence of Active Exploitation

As of now, the Snyk team has not identified any evidence of active exploitation of these vulnerabilities in the wild. However, due to their subtle nature, attacks leveraging these Docker container security flaws may be challenging to detect. This underscores the importance of proactively updating infrastructure and implementing robust security measures for anyone using container technologies.

Securing Container Technologies

Containerization security best practices are essential for ensuring the protection of your systems and data. While containers offer substantial benefits, they also introduce additional risks if not managed properly. The ‘Leaky Vessels’ incident emphasizes that core container components remain a prime target for potential attacks. Snyk’s responsible disclosure highlights the significance of collaboration between vendors and researchers to enhance security.

Ongoing Work to Enhance Security

Despite strides in security collaboration, the prevalence of critical vulnerabilities in foundational tools indicates that there is ongoing work to be done. Organizations utilizing container technologies should prioritize staying up-to-date with the latest security patches and implementing strong controls to detect anomalies, thereby limiting potential damage from cybersecurity threats to container runtimes.

Conclusion

In conclusion, the runC flaw exploits pose a serious risk to containerized environments, emphasizing the need for securing container runtimes and immediate action to update and secure systems. The collaboration between security researchers and vendors plays a crucial role in maintaining the integrity of container technologies. By staying vigilant, updating systems, and implementing robust security measures, organizations can safeguard their Linux systems from potential threats.

The sources for this piece include articles in The Hacker News and Cyber Kendra.

Summary