Summary
CVE-2024-21626 (Leaky Vessels) in runc allows a malicious container image to leak a host-side file descriptor through /proc/self/fd/N, then chdir into it — escaping the chroot and reaching host paths.
Affected Asset
runc (container runtime); Proxmox VE (LXC / Docker via runc); Docker; Podman; containerd; LXC — any stack using runc before 1.1.12.
Affected Endpoint
Container runtime / runc chroot / file descriptor handling path.
Prerequisites
Host running runc < 1.1.12; attacker can push/run a malicious container image; container has access to /proc/self/fd.
Steps to Reproduce
Launch a crafted container image that opens a host file descriptor, leaks it via /proc/self/fd/N, then performs chdir into the leaked descriptor to escape the chroot and access host paths such as /etc/shadow or /root/.ssh/.
Evidence
Public advisory (Noxen) and NVD entry; confirmed container escape demonstrations on Proxmox / LXC homelab setups.
Impact
Critical container escape on homelab hosts; attacker can write /root/.ssh/authorized_keys or read /etc/shadow from inside an unprivileged container; full host compromise.
Root Cause
runc did not properly restrict access to host-side file descriptors within the container's /proc view, allowing a malicious container to reference and chdir into leaked descriptors.
Remediation
Update runc to 1.1.12+; on Proxmox: apt update && apt dist-upgrade (pve-container / lxc-pve packages from Feb 2024); verify with runc --version.
Verification Steps
Run runc --version and confirm >= 1.1.12; run a test malicious container and confirm it cannot escape chroot; check Proxmox package versions.