{"id":"GHSA-g5p6-327m-3fxx","aliases":[],"status":"published","title":"Talos Linux ships runc vulnerable to the escape to the host attack","description":"### Impact\n\nSnyk has discovered a vulnerability in all versions of runc \u003c=1.1.11, as used by the Docker engine, along with other containerization technologies such as Kubernetes. Exploitation of this issue can result in container escape to the underlying host OS, either through executing a malicious image or building an image using a malicious Dockerfile or upstream image (i.e., when using FROM). This issue has been assigned the CVE-2024-21626.\n\n### Patches\n\n`runc` runtime was updated to 1.1.12 in Talos v1.5.6 and v1.6.4.\n\n### Workarounds\n\nInspect the workloads running on the cluster to make sure they are not trying to exploit the vulnerability.\n\n### References\n\n* [CVE-2024-21626](https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv)\n* [Vulnerability: runc process.cwd and leaked fds container breakout](https://snyk.io/blog/cve-2024-21626-runc-process-cwd-container-breakout/)","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-02-02T18:11:06Z","modified":"2024-02-02T18:11:07Z","fixes":[{"ecosystem":"Go","package":"github.com/siderolabs/talos","fixed_in":["1.6.4","1.5.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/siderolabs/talos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/siderolabs/talos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/siderolabs/talos","ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/siderolabs/talos","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.6"}]}]}],"references":[{"url":"https://github.com/siderolabs/talos/security/advisories/GHSA-g5p6-327m-3fxx","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g5p6-327m-3fxx"},{"url":"https://github.com/siderolabs/talos","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-g5p6-327m-3fxx","title":"Talos Linux ships runc vulnerable to the escape to the host attack","description":"### Impact\n\nSnyk has discovered a vulnerability in all versions of runc \u003c=1.1.11, as used by the Docker engine, along with other containerization technologies such as Kubernetes. Exploitation of this issue can result in container escape to the underlying host OS, either through executing a malicious image or building an image using a malicious Dockerfile or upstream image (i.e., when using FROM). This issue has been assigned the CVE-2024-21626.\n\n### Patches\n\n`runc` runtime was updated to 1.1.12 in Talos v1.5.6 and v1.6.4.\n\n### Workarounds\n\nInspect the workloads running on the cluster to make sure they are not trying to exploit the vulnerability.\n\n### References\n\n* [CVE-2024-21626](https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv)\n* [Vulnerability: runc process.cwd and leaked fds container breakout](https://snyk.io/blog/cve-2024-21626-runc-process-cwd-container-breakout/)\n","status":"published","published":"2024-02-02T18:11:06Z","modified":"2024-02-02T18:11:07Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:37:35.293818Z"}],"osv":[{"id":"GHSA-g5p6-327m-3fxx","title":"Talos Linux ships runc vulnerable to the escape to the host attack","description":"### Impact\n\nSnyk has discovered a vulnerability in all versions of runc \u003c=1.1.11, as used by the Docker engine, along with other containerization technologies such as Kubernetes. Exploitation of this issue can result in container escape to the underlying host OS, either through executing a malicious image or building an image using a malicious Dockerfile or upstream image (i.e., when using FROM). This issue has been assigned the CVE-2024-21626.\n\n### Patches\n\n`runc` runtime was updated to 1.1.12 in Talos v1.5.6 and v1.6.4.\n\n### Workarounds\n\nInspect the workloads running on the cluster to make sure they are not trying to exploit the vulnerability.\n\n### References\n\n* [CVE-2024-21626](https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv)\n* [Vulnerability: runc process.cwd and leaked fds container breakout](https://snyk.io/blog/cve-2024-21626-runc-process-cwd-container-breakout/)\n","status":"published","published":"2024-02-02T18:11:06Z","modified":"2024-02-02T18:11:06Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}