Fix CVE-2024-21626 in runc to prevent container escapes that expose the host file system or allow execution of binaries on the host.
Affected versions
runc
| Status | Versions |
|---|---|
| Affected | runc 1.0.0-rc93 through 1.1.11 |
| Fixed | runc 1.1.12 |
ACK clusters
ACK clusters running containerd 1.5.13 or containerd 1.6.20 are affected. Other containerd versions are not vulnerable.
Check your node pool's runtime version on the Basic Information page in the ACK console.
Not affected:
-
Newly added nodes in both newly created and existing ACK clusters (the upgrade has already been applied)
-
ACK clusters using the Docker runtime
Solutions
Upgrade the container runtime (recommended)
Monitor the containerd release notes and upgrade your ACK cluster runtimes to a patched version by following Node pool updates.
Restrict image sources
Use the ACKAllowedRepos policy (Configure and enforce ACK pod security policies) to allow only images from trusted repositories. Restrict image import permissions to trusted users per the least privilege principle.
Verify container image integrity
Sign container images and use kritis-validation-hook to verify image signatures: