Detections
Analytics

Bottlerocket: runc: security update to 2.4.0

medium Tenable Self-Hosted Container Security Plugin ID 427982

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and
 earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in
 arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a
 race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be
 truncated. An attacker must have the ability to start containers using some kind of custom volume
 configuration. Containers using user namespaces are still affected, but the scope of places an attacker
 can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can
 also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this
 attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc
 directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3. Some
 workarounds are available. Using user namespaces restricts this attack fairly significantly such that the
 attacker can only create inodes in directories that the remapped root user/group has write access to.
 Unless the root user is remapped to an actual user on the host (such as with rootless containers that
 don't use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes
 in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict
 the scope if a specific label is applied to the runc runtime, though neither the extent to which the
 standard existing policies block this attack nor what exact policies are needed to sufficiently restrict
 this attack have been thoroughly tested. (CVE-2024-45310)

Plugin Details

Severity: Medium

ID: 427982

Version: Revision 1.4

Type: Local

Published: 6/30/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2024-45310

CVSS v3

Risk Factor: Low

Base Score: 3.6

Temporal Score: 3.2

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.8

Threat Score: 1.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/3/2024

Reference Information

CVE: CVE-2024-45310