# Leaky Vessels: runC and BuildKit container escape vulnerabilities - everything you need to know

runC leaked file descriptors and BuildKit mount races let crafted images/Dockerfiles escape the container to read/write the host filesystem.

- Payout: Research
- Severity: high
- Program: runC
- Credited: Wiz Research
- Disclosed: 2024-02-05
- CVE: CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, CVE-2024-23653
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/leaky-vessels-container-escape-vulnerabilities
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-leaky-vessels-container-escape-vulnerabilities
- Tags: domain:cloud domain:infra impact:privesc impact:rce kind:research platform:threat-intel sev:high tech:docker tech:kubernetes vuln:path-traversal vuln:privilege-escalation vuln:race-condition vuln:rce

**Target:** runC CLI and BuildKit build daemon (container runtime/build)
**Root cause:** runC up to v1.1.11 leaks an open fd (e.g. /sys/fs/cgroup) into the container process, so a WORKDIR of /proc/self/fd/N leaves the process cwd on the host filesystem; BuildKit up to v0.12.4 has cache-mount subpath races, mountpoint cleanup traversal, and missing entitlement checks on interactive container APIs.
**Steps:**
1. Craft Dockerfile: `FROM ubuntu` then `WORKDIR /proc/self/fd/[9]` (fd of /sys/fs/cgroup)
2. Build/run the image so the child process cwd resolves to host /sys/fs/cgroup
3. Traverse up: `RUN cd ../../../../../ && cat etc/shadow` to read/write host files
4. For CVE-2024-23651: run two concurrent build steps sharing identical cache mounts with subpaths to race host files writable
5. For CVE-2024-23652: use RUN --mount to trick empty-mountpoint cleanup into deleting a host file outside the container
6. For CVE-2024-23653: call BuildKit interactive container APIs to run a container with elevated privileges without security.insecure entitlement
**How found:** Observed that runC leaks file descriptors into spawned container processes and that procfs paths (/proc/self/fd/N) as WORKDIR resolve outside the container root; also noted BuildKit cache-mount subpath handling and mountpoint cleanup logic as race/traversal surfaces.
**Exploitation:** Attacker controls the image, Dockerfile, BuildKit frontend, or launch args (e.g. workdir), or plants a trap for a victim running `runc exec` into an internet-facing container; the crafted WORKDIR/fd gives host filesystem access, enabling overwrite of host binaries and full container escape, or code execution on the build runner host.
**Escalation:** Escape from pod to Kubernetes node in multi-tenant clusters, then lateral access to other tenants' pods; or foothold in build pipeline yielding privileged production credentials.
**Insight:** When auditing container runtimes, check whether inherited fds survive into the child and whether cwd/chroot resolution via /proc/self/fd can escape the rootfs; for build systems, look at concurrent cache-mount subpath handling and mountpoint cleanup as traversal primitives.