CVE-2024-21626
Public on 2024-01-31
Modified on 2024-06-07
Description
AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management systems. Under certain conditions, an actor could leverage a specially crafted container or container configuration to access files or directories outside the container’s file system namespace.
An updated version of runc that addresses the issue is available for HAQM Linux 1 (runc-1.1.11-1.0.amzn1), HAQM Linux 2 (runc-1.1.11-1.amzn2) and for HAQM Linux 2023 (runc-1.1.11-1.amzn2023). AWS recommends that customers using runc or any container-related software apply those updates or a newer version.
An updated version of runc that addresses the issue is available for HAQM Linux 1 (runc-1.1.11-1.0.amzn1), HAQM Linux 2 (runc-1.1.11-1.amzn2) and for HAQM Linux 2023 (runc-1.1.11-1.amzn2023). AWS recommends that customers using runc or any container-related software apply those updates or a newer version.
Severity
Important
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| HAQM Linux 2 - Aws-nitro-enclaves-cli Extra | containerd | Not Affected | ||
| HAQM Linux 2 - Docker Extra | containerd | Not Affected | ||
| HAQM Linux 2 - Ecs Extra | containerd | Not Affected | ||
| HAQM Linux 1 | runc | 2024-01-25 | ALAS-2024-1911 | Fixed |
| HAQM Linux 2 - Docker Extra | runc | 2024-01-25 | ALAS2DOCKER-2024-036 | Fixed |
| HAQM Linux 2 - Ecs Extra | runc | 2024-01-31 | ALAS2ECS-2024-033 | Fixed |
| HAQM Linux 2 - Aws-nitro-enclaves-cli Extra | runc | 2024-01-25 | ALAS2NITRO-ENCLAVES-2024-036 | Fixed |
| HAQM Linux 2023 | runc | 2024-01-25 | ALAS2023-2024-501 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| HAQM Linux | CVSSv3 | 8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | CVSSv3 | 8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |