runc 1.1.11 File Descriptor Leak Privilege Escalation

runc versions 1.1.11 and below, as used by containerization technologies such as Docker engine and Kubernetes, are vulnerable to an arbitrary file write vulnerability. Due to a file descriptor leak it is possible to mount the host file system with the permissions of runc (typically root). Successfully tested on Ubuntu 22.04 with runc 1.1.7-0ubuntu1~22.04.1 using Docker build.

arbitrary file write containerization docker docker engine engine escalation file file system file write vulnerability host host file kubernetes leak permissions privilege privilege escalation root runc system technologies ubuntu ubuntu 22.04 vulnerability vulnerable