CVE-2024-45310: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc
Summary
CVE-2024-45310: Can be confused to create empty files/directories on the host in github.com/opencontainers/runc. Affects github.com/opencontainers/runc across 2 version ranges.
< 1.1.14
>= 1.2.0-rc.1, < 1.2.0-rc.3
Fixed in 1.1.14 or 1.2.0-rc.3, depending on the release line you run. How to fix ↓
Also tracked for
- runc · Debian:11
The same CVE-2024-45310 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/opencontainers/runc is an open-source Go package that provides a lightweight container runtime for Linux. It is widely used in containerization technologies and allows users to create and manage containers on a host system. However, a vulnerability has been discovered in runc that can lead to the creation of empty files or directories on the host system.
Vulnerability Detail
The vulnerability in runc arises from a confusion issue, which can be exploited to manipulate the creation of files or directories on the host system. An attacker could potentially abuse this vulnerability to fill up the host's storage with empty files or directories, causing denial of service or impacting the system's performance. The vulnerability affects versions 0.x, 1.2.0-rc.1, and all versions prior to 1.1.14 and 1.2.0-rc.3.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.1.141.1.14go get github.com/opencontainers/runc@v1.1.14 -
>= 1.2.0-rc.1, < 1.2.0-rc.31.2.0-rc.3go get github.com/opencontainers/runc@v1.2.0-rc.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can temporarily mitigate the risk by implementing strict access controls and monitoring the creation of files or directories on the host system. Additionally, it is advisable to limit the privileges of the runc process and ensure that it runs in a restricted environment.
Conclusion
The vulnerability in runc can lead to the creation of empty files or directories on the host system, potentially causing denial of service or performance issues. It is crucial to update runc to version 1.1.14 or 1.2.0-rc.3 to mitigate this vulnerability. Implementing strict access controls and monitoring file/directory creation can serve as temporary workarounds.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
runc is an open-source Go package that provides a lightweight container runtime for Linux. It allows users to create and manage containers on a host system.
The vulnerability in runc can be exploited to create empty files or directories on the host system, potentially leading to denial of service or performance issues.
Versions 0.x, 1.2.0-rc.1, and all versions prior to 1.1.14 and 1.2.0-rc.3 are affected by this vulnerability.
To fix this vulnerability, update runc to version 1.1.14 or 1.2.0-rc.3. You can do this by running the appropriate package manager command or manually installing the updated version.
As a temporary workaround, implement strict access controls, monitor file/directory creation, and limit the privileges of the runc process.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
