Leaky Vessels Vulnerabilities Could Allow Attackers to Gain Unauthorized Access to Host OS 

The vulnerabilities collectively known as “Leaky Vessels” represent a series of four (4) security flaws discovered in November 2023 by Snyk security researcher Rory McNamara.  If exploited, the vulnerabilities could allow hackers to bypass container isolation mechanisms and gain unauthorized access to the host operating system. These vulnerabilities, identified as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, affect the runc and Buildkit components widely used in container management software like Docker and Kubernetes. Although there is currently no evidence of active exploitation, the potential risks mandated urgent advisories for system administrators to update their systems. The flaws range from an order-of-operations bug to inadequate privilege checks, each presenting unique threats to containerized environments. Fixes were coordinated among the affected projects and released on January 31, 2024, with Docker, AWS, Google Cloud, Ubuntu, and others issuing updates and security bulletins to mitigate the risks. This incident highlights the importance of time-sensitive vulnerability management, especially given the potential for widespread impacts that vulnerabilities in fundamental infrastructure components can cause across the cloud computing landscape. CTIX analysts recommend that all system administrators ensure that their infrastructure is up-to-date.