CVE-2024-21626
A critical vulnerability, CVE-2024-21626, has been identified in runc. This vulnerability, caused by an internal file descriptor leak, allows attackers to gain access to the host filesystem and potentially execute a full container breakout. Systems running runc versions up to 1.1.11 are affected, with the issue being patched in version 1.1.12.
At Aqua Security, we can reassure our customers and the wider community about the robustness of our security posture. A thorough review has confirmed that Aqua images are not susceptible to the vulnerabilities outlined. Although our images do incorporate runc libraries, these are categorized as indirect dependencies and thus do not present a vulnerability vector in our environment.
