Impact
CVE-2024-21626 can allow a malicious image or a process involved in container execution to escape an affected runc container and access the host filesystem. Variants documented by the runc maintainers can also overwrite host binaries and lead to complete host compromise [S1]. NVD records the same container-breakout behavior and the runc 1.1.12 fix [S2].
Root cause and affected versions
The upstream advisory covers runc versions from 1.0.0-rc93 through 1.1.11. Internal file descriptors could remain available to the container process, and affected releases did not verify that the final working directory stayed inside the container mount namespace [S1]. A malicious container working directory such as /proc/self/fd/7 could therefore resolve into the host namespace. runc 1.1.12 closes the leaked descriptors and validates the working directory before execution [S1].
Covered by FixVibe
Connected GitHub repo scans now flag Dockerfile and Kubernetes workload configuration associated with this container-breakout condition. Findings identify the affected repository file and configuration location, use a Likely issue evidence posture, and state that the confidence applies to the source/configuration match.
FixVibe does not run images or containers, access host files, overwrite binaries, or attempt a breakout. A repo finding does not prove that the configuration is deployed, that the host uses runc, or that the deployed runtime falls in the affected version range. Customers should verify the actual runtime inventory before treating the finding as confirmed live exploitation.
Remediation
Replace the container working directory with a normal path inside the image. Upgrade every Docker, containerd, Kubernetes node, CI runner, build host, and standalone runtime that can execute the workload to runc 1.1.12 or newer, or to a vendor package documented as patched for CVE-2024-21626 [S1]. Rebuild and redeploy reviewed images and manifests so stale artifacts cannot preserve the risky configuration.
Because this working-directory condition is highly unusual, review the introducing commit, image provenance, registry signatures, admission and audit logs, and container activity. Escalate through the owner's incident-response process if the configuration reached a runnable environment.