Moderate: runc security update
Summary
ALSA-2024:6188: Moderate: runc security update. Affects runc versions < 4:1.1.12-4.el9_4. Fixed in 4:1.1.12-4.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. It is used to create and run containers on various platforms. Containers are isolated environments that package applications and their dependencies, allowing for easy deployment and scalability. runC is widely used in containerization technologies such as Docker and Kubernetes.
Vulnerability Detail
The vulnerability (CVE-2024-24783) affects the runC tool and is related to the handling of certificates with an unknown public key algorithm in the crypto/x509 package of the Go programming language. When runC encounters such certificates, a verification process can trigger a panic, leading to a denial of service (DoS) condition. An attacker could exploit this vulnerability by providing a specially crafted certificate to a containerized application, causing it to crash or become unresponsive. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
4:1.1.12-4.el9_4
This is the first release that contains the fix.
sudo dnf update runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to mitigate the risk of exploitation.
Conclusion
The runC tool, used for container runtime, is affected by a moderate-level vulnerability (CVE-2024-24783) related to the handling of certificates with unknown public key algorithms. This vulnerability can lead to a denial of service (DoS) condition in containerized applications. To mitigate the risk, it is recommended to update the runC package to version 4:1.1.12-4.el9_4 or later. No known workarounds are available for this vulnerability.
See every vulnerability recorded for runc →
FAQ
runC is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. It is used to create and run containers on various platforms.
The vulnerability can lead to a denial of service (DoS) condition in containerized applications. An attacker could exploit this vulnerability to crash or make the application unresponsive.
To fix this vulnerability, update the runC package to version 4:1.1.12-4.el9_4 or later. This update includes a patch that addresses the issue.
There is no known workaround for this vulnerability. It is crucial to apply the security update to mitigate the risk.
The security update can be obtained from the official AlmaLinux repositories or through package management tools like yum or dnf.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
