Database/Container, Kubernetes & orchestration
runc: "Leaky Vessels": internal file descriptor leak lets a container process start with cwd in the host filesystem
Impact
"Leaky Vessels": internal file descriptor leak lets a container process start with cwd in the host filesystem; full host escape
Who can reach it
Malicious image (a crafted WORKDIR is enough) or any tenant workload
What to do
Replace runc on all nodes; running containers stay vulnerable, so drain and recreate all GPU pods
Fleet impact
How widespread
Universal - runc is the default OCI runtime under Docker, containerd, CRI-O and therefore under essentially every GPU container on every neocloud
Cost to remediate
node-drain - the runc binary is replaced on the host, and while the swap itself is atomic, already-running containers keep the vulnerable runtime semantics; safe remediation means evacuating and recreating every container, i.e. draining paying GPU jobs off each node
Why it hits the whole fleet
A leaked file descriptor lets any customer-supplied container image (or docker exec) land its working directory in the host filesystem namespace, giving host root from an untrusted tenant workload on every node in the fleet
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.