Sploitus

Exploit for File Descriptor Leak in Linuxfoundation Runc

CVE-2024-21626

githubexploit · 2024-02-02

Exploit Code

README33 lines
## https://sploitus.com/exploit?id=AF146DC3-6A91-5DE1-B15A-1D86A070F915
# CVE-2024-21626-POC

# Instructions
For educational/research purposes only. Any actions unrelated to education/research carry corresponding risks on one’s own.

# Usage
## Verification
```bash
bash verify.sh
```
## Escape Verification
```bash
# verify.sh will determine the correct fd value for the current machine environment. If fd is not 9, modify WORKDIR in the Dockerfile to the correct value, or specify it using -w in the docker run command.
docker build . -t cve-2024-21626
docker run -it --rm cve-2024-21626 bash /poc.sh
# Start a new terminal
/bin/bash.copy
```

# Prerequisites
The following conditions must be met:
1. The kernel supports openat2 (kernel version >= 5.6).
2. It is possible to create containers and specify execution commands.
3. It is possible to specify the image used by the container.

# Vulnerability Details
TODO

# References
https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv

https://github.com/opencontainers/runc/commit/2a4ed3e75b9e80d93d1836a9c4c1ebfa2b78870e