CVE-2024-21626: runc WORKDIR leaks a privileged host file descriptor into the container
Scope: audit · README · COMPARISON · docs/RESEARCH
CVSS 8.6 ("Leaky Vessels"). Affects runc <= 1.1.11.
Source
Relevance to doos
runc changed the process's working directory with fchdir before closing a privileged
host directory file descriptor it had open during setup. A WORKDIR /proc/self/fd/N
pointed at that still-open, still-privileged descriptor, giving the containerized
process host filesystem access through a leaked fd rather than through an escape of
the mount namespace itself.
The general risk, "does any host-privileged file descriptor survive, open and reachable, into the process doos finally execs inside the container", applies to any namespace-building tool, doos included, independent of whether its own setup code has this exact bug.
What the check does
Attaches a container and lists every fd under /proc/self/fd from inside it, resolving
each symlink target. Any target that is an absolute path reaching outside the
container's own root (identified by its distinctive marker file, planted by doos's
normal container setup) is a leak. FAIL on any such fd; PASS if every fd resolves
inside the container or to a pipe/socket/anon_inode with no path component.
Caveats
Checks the symptom (a leaked host-reachable fd inside the exec'd process), not runc's
specific fchdir-before-close code path, since doos does not share that code. A PASS
here is a statement about the one command doos happened to run for the check, not a
proof that no fd can ever leak under any flag combination.
Run: make test in this directory, or make -C audit test from the repo root.