Understanding the runc 1.1.11 Container Escape Bug and How to Secure Your Hosts
The article explains the runc 1.1.11 container‑escape vulnerability (CVE‑2024‑21626), how it allows attackers to break out of containers and gain host privileges, details Huawei Cloud’s reproduction steps, and provides mitigation guidance including upgrading to runc 1.1.12 and using HSS scanning and intrusion‑detection features.
runc official security advisory reveals a container‑escape vulnerability in runc 1.1.11 and earlier versions, allowing attackers to escape containers and obtain host privileges.
What is runc?
runc is a CLI tool that creates and runs containers according to the OCI standard; Docker, containerd, CRI‑O, and Podman all run on top of runc.
Vulnerability details
The vulnerability (CVE‑2024‑21626) can be exploited by configuring a special workdir path, enabling the container to read host files. Huawei Cloud Security Service (HSS) successfully reproduced the exploit in a Docker environment. The following images illustrate the vulnerability and its reproduction.
Impact range
Versions rc93 ≤ runc ≤ 1.1.11 are affected.
Mitigation recommendations
Security update : Upgrade to the latest runc version (1.1.12) which contains the fix.
HSS vulnerability scanning : Use Huawei Cloud Security Service to scan for the runc escape vulnerability and follow the console steps to initiate an immediate scan.
Intrusion detection : HSS HIPS rules generate real‑time alerts when exploitation is detected; view alerts in the “Host Security Alerts” page.
Signed-in readers can open the original source through BestHub's protected redirect.
This article has been distilled and summarized from source material, then republished for learning and reference. If you believe it infringes your rights, please contactand we will review it promptly.
Huawei Cloud Developer Alliance
The Huawei Cloud Developer Alliance creates a tech sharing platform for developers and partners, gathering Huawei Cloud product knowledge, event updates, expert talks, and more. Together we continuously innovate to build the cloud foundation of an intelligent world.
How this landed with the community
Was this worth your time?
0 Comments
Thoughtful readers leave field notes, pushback, and hard-won operational detail here.