Vulmon
Amazon Linux 2 Security Advisory: ALASECS-2024-033
Advisory Release Date: 2024-01-31 20:51 Pacific
Advisory Updated Date: 2024-01-31 22:00 Pacific
AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management systems. Under certain conditions, an actor could leverage a specially crafted container or container configuration to access files or directories outside the container's file system namespace.
An updated version of runc that addresses the issue is available for Amazon Linux 1 (runc-1.1.11-1.0.amzn1), Amazon Linux 2 (runc-1.1.11-1.amzn2) and for Amazon Linux 2023 (runc-1.1.11-1.amzn2023). AWS recommends that customers using runc or any container-related software apply those updates or a newer version. (CVE-2024-21626)
Affected Packages:
runc
Note:
This advisory is applicable to Amazon Linux 2 - Ecs Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update runc to update your system.
aarch64:
runc-1.1.11-1.amzn2.aarch64
runc-debuginfo-1.1.11-1.amzn2.aarch64
src:
runc-1.1.11-1.amzn2.src
x86_64:
runc-1.1.11-1.amzn2.x86_64
runc-debuginfo-1.1.11-1.amzn2.x86_64