Security Update for runc: Mitigating Infinite Loop Vulnerability in DNS Processing
Summary
ALSA-2024:9200: Moderate: runc security update. Affects runc versions < 4:1.1.13-4.el9. Fixed in 4:1.1.13-4.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
runC is a lightweight and portable implementation of the Open Container Format (OCF), serving as a container runtime that allows users to run containers on various platforms. It is widely used in container orchestration systems and is integral to the functioning of containerized applications. The recent vulnerability discovered in runC pertains to the handling of malformed DNS messages, which can lead to an infinite loop, potentially causing denial of service in applications relying on this functionality.
Vulnerability Detail
The vulnerability identified as CVE-2024-24788 arises from a flaw in the golang net package used by runC. Specifically, malformed DNS messages can trigger an infinite loop within the DNS processing logic. This can lead to excessive resource consumption, resulting in degraded performance or complete unavailability of services that depend on runC for container management. The issue is particularly critical for environments that rely heavily on DNS for service discovery and communication.
How To Fix
Minimum fixed version
4:1.1.13-4.el9
This is the first release that contains the fix.
sudo dnf update runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their applications to malformed DNS messages by implementing strict validation on DNS inputs or by using alternative DNS resolution methods until the update can be applied.
Conclusion
The discovery of CVE-2024-24788 in runC highlights the importance of maintaining up-to-date software to mitigate potential security risks. By applying the recommended updates and considering workarounds, users can protect their applications from the adverse effects of this vulnerability.
See every vulnerability recorded for runc →
FAQ
CVE-2024-24788 is a vulnerability in the golang net package used by runC, which can cause an infinite loop when processing malformed DNS messages.
This vulnerability can lead to excessive resource consumption and potential denial of service, impacting the availability of applications that utilize runC for container management.
If an immediate update is not possible, consider implementing strict DNS input validation or using alternative DNS resolution methods as a temporary workaround.
For detailed information about the security update and its implications, refer to the AlmaLinux Release Notes and the CVE page for CVE-2024-24788.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can check for vulnerabilities using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
