Runc Package Security Update Advisory (CVE-2024-21626)

Overview

An update has been made available to fix vulnerabilities in the Runc package. Users of affected versions are advised to update to the latest version.
 

Affected Products

All versions of Runc 1.1.11 and earlier

 

Resolved Vulnerabilities

Container escape vulnerability due to file descriptor leak in the runc package (CVE-2024-21626)

 

Vulnerability Patches

Vulnerability patches were made available in the February 1, 2024 update. Please follow the instructions on the reference site to update to the latest vulnerability patch version.

Runc 1.1.12 version

 

Referenced Sites

[1] CVE-2024-21626 Detail
https://nvd.nist.gov/vuln/detail/CVE-2024-21626
[2] runc 1.1.12 — “Now you’re thinking with Portals™!”
https://github.com/opencontainers/runc/releases/tag/v1.1.12
[3] RHSB-2024-001 Leaky Vessels – runc – (CVE-2024-21626)
https://access.redhat.com/security/vulnerability/RHSB-2024-001