Leaky Vessels: Container Escape in runc

Repository purpose: a reproducible lab + PoCs demonstrating two runc container-escape vulnerabilities (CVE-2024-21626 and CVE-2025-31133) and optional eBPF-based enforcement/detection using Cilium Tetragon. Key exploit capabilities: - CVE-2024-21626 PoC (files/pocs/cve-2024-21626.py): builds a minimal OCI bundle and runs runc with process.cwd set to /proc/self/fd/7 (commented as a symlink to /sys/fs/cgroup). The container process runs /bin/touch with a relative path (../../../pwned_by_cve_2024_21626) to create a marker file on the host, demonstrating escape/write outside the container rootfs. - CVE-2025-31133 PoC (files/pocs/cve-2025-31133.py): builds a minimal OCI bundle and launches a container, then runs a tight race that repeatedly replaces bundle/rootfs/dev/null with either a real /dev/null copy or a symlink to /proc/sys/kernel/core_pattern. It then uses runc exec to write a pipe handler ("|/bin/touch /pwned_by_cve_2025_31133") into core_pattern and verifies it by reading the sysctl. On success it triggers SIGSEGV inside the container to cause the kernel to execute the core_pattern handler as root, creating the marker file. Defensive/detection content: - files/rules/cve-2024-21626.yaml: Tetragon TracingPolicy kprobe on sys_chdir; matches /proc/*/fd/{6,7,8} when binary ends with /runc; posts an event and overrides with -EPERM to block. - files/rules/cve-2025-31133.yaml: Tetragon TracingPolicy kprobe on sys_openat; blocks writes (O_WRONLY/O_RDWR) to /proc/sys/kernel/core_pattern from non-host mount namespaces. Lab/provisioning structure: - terraform/*: provisions an AWS EC2 instance, installs a chosen runc version (locals.tf pins 1.1.11 by default), installs Tetragon, copies PoCs and utilities to /pocs and /utils, deploys tracing policies to /etc/tetragon/tetragon.tp.d, and sets the setuid bit on /usr/local/bin/runc (increasing realism for local-priv scenarios). - Makefile: wraps terraform init/apply/destroy and provides an ssh convenience target. - files/utils/reset.sh: cleans marker files and resets kernel.core_pattern. - files/utils/performance.py + data/*.csv: local-only CPU/load measurement tooling and sample outputs; not used by the exploit itself. Overall: This is an operational PoC repo (not a framework module) focused on local container escape primitives against vulnerable runc, with clear host-side proof artifacts and optional eBPF policy enforcement to demonstrate mitigation.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-21626, a container escape vulnerability in runc versions 1.1.11 and below. The exploit leverages a file descriptor leak of /sys/fs/cgroup into the container's init process, allowing the container's working directory (cwd) to be set to a host file descriptor (e.g., /proc/self/fd/7). This enables processes inside the container to access the host filesystem, effectively escaping the container. The repository contains four files: a Makefile for automation, a README.md with detailed vulnerability and exploitation steps, and two bash scripts (poc-autoplay.sh and poc-uninstall.sh). The main exploit logic is in poc-autoplay.sh, which automates the setup of a vulnerable runc environment, ensures the correct Docker and Go versions, builds and installs a vulnerable runc, prepares an Alpine rootfs, patches the container's config.json to set cwd to /proc/self/fd/7, and provides instructions to run the exploit. The uninstall script restores the original runc binary and cleans up the environment. The exploit is local in nature, requiring the ability to run containers and modify binaries on the target system. No remote endpoints are involved, but several fingerprintable file paths are used, such as /proc/self/fd/7 and /usr/bin/runc. The PoC demonstrates the vulnerability and provides a clean-up script for safe testing.

This repository contains a single Metasploit module (runc_cwd_priv_esc.rb) that exploits CVE-2024-21626, a file descriptor leak in runc (used by Docker and Kubernetes) on Linux. The exploit allows an attacker with an existing session on a vulnerable host to escalate privileges to root by abusing Docker to set the SUID bit on a payload executable. The module checks for the presence and version of runc and Docker, uploads a payload and Dockerfile to a writable directory (default: /tmp), builds a Docker image to manipulate file permissions via the vulnerable file descriptor, and executes the payload as root. The default payload is a meterpreter reverse shell, but any compatible Metasploit payload can be used. The exploit is weaponized, part of the Metasploit framework, and targets Linux systems running runc <=1.1.11. No network endpoints are hardcoded; the attack is local and requires the ability to execute commands on the target.

This repository is a proof-of-concept (POC) exploit for CVE-2024-21626, a container escape vulnerability in opencontainers runc on Linux (kernel >= 5.6). The repository contains four files: a Dockerfile for building a vulnerable container environment, a README.md with usage instructions and prerequisites, poc.sh (the main exploit script), and verify.sh (a helper script to check for vulnerable file descriptors). The exploit works by creating a malicious bash script in the host's /bin directory that, when executed, initiates a reverse shell to the attacker's machine. The exploit leverages the ability to set the container's working directory to a file descriptor that allows access to the host filesystem, thus enabling container escape. The payload is a bash reverse shell, and the exploit listens on TCP port 1337 for incoming connections. The repository is operational and demonstrates a working container escape with a reverse shell payload.

This repository provides proof-of-concept (POC) exploit scripts for CVE-2024-21626, a container escape vulnerability in runc (opencontainers) affecting versions v1.0.0-rc93 through 1.1.11. The exploit leverages leaked file descriptors when a container is started with a malicious image and attacker-controlled WORKDIR, allowing the attacker to access and overwrite files on the host system from within the container. The repository contains three main Bash scripts: - poc.sh: Overwrites the host's root crontab to schedule a reverse shell, then listens for a connection, achieving persistence and remote code execution on the host. - poc2.sh: Creates a malicious bash binary on the host that, when executed, provides a reverse shell to the attacker. - verify.sh: Scans for a valid leaked file descriptor by attempting to read the host's /etc/passwd file from various /proc/self/fd/* paths, confirming the vulnerability. A Dockerfile is provided to build a test environment, setting the WORKDIR to a specific file descriptor. The README.md explains the vulnerability, exploitation steps, and mitigation (upgrading runc to 1.12+). The exploit requires the victim to run a container from a malicious image and for the attacker to execute commands inside the container. If successful, the attacker can escape the container and execute arbitrary commands on the host, typically resulting in a reverse shell.