Saint Leaky Vessels, Patron of Leaking Containers

Patron of containers that were supposed to stay isolated, file descriptors left open, and anyone running docker build on unknown images.

Life

On 31 January 2024 Snyk revealed four vulnerabilities at the heart of Docker: one in runc and three in BuildKit. The worst came from a file descriptor left open: a container could find its working directory inside the host filesystem, and from there step off its ship onto dry land.

Prayer

O Saint Leaky Vessels, who shipwrecks isolation, let our descriptors close and our containers stay on board. Amen.

How to celebrate

Celebrated by updating runc and BuildKit, and rebuilding every image while the coffee goes cold.

A leaking ship touches land sooner or later.

Technical record

Disclosed on: January 31 2024
CVE: CVE-2024-21626 CVE-2024-23651 CVE-2024-23653 CVE-2024-23652
CVSS: 10.0
Product: opencontainers · runc

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

Sources: labs.snyk.io

Canonized by Pope Xzorcist I

Saint Leaky Vessels, Patron of Leaking Containers

Life

Prayer

How to celebrate

Technical record

Related saints

The “leak” family

Same year: 2024