{"schema_version":"1.3.1","id":"GO-2024-2491","modified":"2024-07-01T21:50:42Z","published":"2024-06-28T15:28:53Z","aliases":["CVE-2024-21626","GHSA-xr7r-f8xq-vfvv"],"summary":"Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc","details":"Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc","affected":[{"package":{"name":"github.com/opencontainers/runc","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0-rc93"},{"fixed":"1.1.12"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/opencontainers/runc/libcontainer/utils","symbols":["CloseExecFrom"]},{"path":"github.com/opencontainers/runc/libcontainer/cgroups","symbols":["openFile","prepareOpenat2"]},{"path":"github.com/opencontainers/runc/libcontainer","symbols":["Container.start","Init","finalizeNamespace","linuxSetnsInit.Init","linuxStandardInit.Init"]}]}}],"references":[{"type":"ADVISORY","url":"https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv"},{"type":"FIX","url":"https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf"},{"type":"WEB","url":"http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html"}],"credits":[{"name":"Rory McNamara from Snyk"},{"name":"@lifubang from acmcoder"},{"name":"Aleksa Sarai from SUSE"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2024-2491","review_status":"REVIEWED"}}