● Cloud-Native · April 2026

Kubernetes Security Advisory: April 2026 runc 'Leaky Vessels' Breakout Triage

Technical triage of the landmark Leaky Vessels runc container breakout (CVE-2024-21626) affecting Docker, Kubernetes, and containerd.

4
Container Runtimes
1
Landmark Host Breakout
8.6
CVSS runc Flaw
Critical
Worldwide Infrastructure

漏洞风险分类与修复裁决

The cloud-native ecosystem deployed emergency patches for CVE-2024-21626 (*Leaky Vessels*) in runc. An internal file descriptor pointing to /proc/self/cwd on the host leaked into the container process, allowing complete host filesystem breakout.

重点漏洞分类评级矩阵

CVE 编号 核心子系统 / 组件 影响程度 CVSS 是否在野利用？
CVE-2024-21626runc / containerdContainer Host Breakout8.6 HighYES (In-The-Wild)
CVE-2024-21627BuildKit Image BuilderPrivilege Escalation7.8 HighNo
CVE-2024-21628Docker Daemon EngineShared Memory Leak6.2 MediumNo
深度源码剖析

Deep Dive: runc 'Leaky Vessels' Container Breakout Teardown →

Inspect the Go commit in libcontainer/init_linux.go ensuring all internal /proc file descriptors are strictly closed with O_CLOEXEC before execve.

← 浏览完整安全目录 所有平台安全更新 →