PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2024-21626] Leaky Vessels: runC and BuildKit container escape vulnerabilities - everything you need to know

wiz.io | blog | CVE-2024-21626 | #kubernetes | #containers | #container-escape | #runc | #cve-2024-21626 | #buildkit
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The 'Leaky Vessels' flaws in runC (CVE-2024-21626) and BuildKit (three CVEs) enable container escapes to the host filesystem, hitting multi-tenant Kubernetes hardest; patching is urged.
CVE
CVE-2024-21626
Published
Collected

Related coverage

vulnerability · aikido.dev
A Guide to Container Privilege Escalation Vulnerabilities
Container isolation breaks down when attackers escalate privileges, turning a low-privileged foothold into full host compromise. The guide covers CVE-2019-5736, CVE-2024-21626, and prevention.
blog · aikido.dev
Top 9 Docker Container Security Vulnerabilities
Every FROM instruction and installed package in an image is a potential attack vector. The list spans nine Docker vulnerabilities, from runC breakouts to hardcoded secrets and excessive privileges.
research · blog.quarkslab.com
Digging Into Runtimes – runc
A deep dive into runc, the standardized low-level runtime beneath Docker: container history from LXC to OCI, and how runc spawns and manages containers on Linux.
research · blog.quarkslab.com
Kubernetes and HostPath, a Love-Hate Relationship
The history of three Kubernetes vulnerabilities tied to the hostPath volume type, how they were patched, and how their exploitation exposed the underlying host filesystem.
blog · wiz.io
Wiz Sensor on GKE. 1-Click Runtime Protection, Now Native.
# Wiz Sensor on GKE. 1-Click Runtime Protection, Now Native. Enable native runtime protection for GKE in just one click. The Wiz Runtime Sensor add-on now automates deployment and credential...
blog · wiz.io
Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts
Secure your Kubernetes supply chain with WizOS Helm Charts. Eliminate hidden CI/CD risks and unmaintained dependencies with hardened, signed, and CVE-scanned charts for seamless Kubernetes deployment.
Back