CVE-2024-21626

Public on 2024-01-31
Modified on 2024-06-07
Description
AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management systems. Under certain conditions, an actor could leverage a specially crafted container or container configuration to access files or directories outside the container’s file system namespace.

An updated version of runc that addresses the issue is available for Amazon Linux 1 (runc-1.1.11-1.0.amzn1), Amazon Linux 2 (runc-1.1.11-1.amzn2) and for Amazon Linux 2023 (runc-1.1.11-1.amzn2023). AWS recommends that customers using runc or any container-related software apply those updates or a newer version.
Severity
Important severity
Important
CVSS v3 Base Score
8.6
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra containerd Not Affected
Amazon Linux 2 - Docker Extra containerd Not Affected
Amazon Linux 2 - Ecs Extra containerd Not Affected
Amazon Linux 1 runc 2024-01-25 ALAS-2024-1911 Fixed
Amazon Linux 2 - Docker Extra runc 2024-01-25 ALAS2DOCKER-2024-036 Fixed
Amazon Linux 2 - Ecs Extra runc 2024-01-31 ALAS2ECS-2024-033 Fixed
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra runc 2024-01-25 ALAS2NITRO-ENCLAVES-2024-036 Fixed
Amazon Linux 2023 runc 2024-01-25 ALAS2023-2024-501 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD CVSSv3 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H