RunC Flaws Enable Container Escapes, Granting Attackers Host Access
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-5736 | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host… | 8.6 | 98% | PoC ×4 | |
| CVE-2024-21626 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification | 8.6 | 19% | PoC ×2 | |
CVE-2024-23653+2 related CVEs | BuildKit: In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built… | 9.8 group max | 3% |
From the original article
3 min read at thehackernews.com
Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed Leaky Vessels by cybersecurity vendor Snyk.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.