Tested exploit/linux/local/runc_cwd_priv_esc on arch linux runc 1.1.4

[rolf-d2i]

Summary

Tested exploit/linux/local/runc_cwd_priv_esc on arch linux to extend access with docker runc exploit.
Running Linux runc version 1.1.4 the exploit did not complete with success.

The exploit claims this system should have been vulnerable, but actual execution on host shows the exploit did not complete with success on arch linux. The Documentation on the exploit should be updated to document this, it is either is a bug, or arch linux is not vulnerable to this exploit, or the documentation is insufficient to correctly replicate the vulnerability.

Git link to exploit code tested https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/runc_cwd_priv_esc.rb

[oddlittlebird]

Metasploit folx, if someone can provide this technical writer a little guidance on what needs updating, then I'd be happy to update this for you.

[h00die]

Arch linux is not directly supported (or tested) by the module (although it may still work). https://security.archlinux.org/issues/vulnerable does not list cve-2024-21626 (although there's nothing from 2024, so likely the list isn't kept up to date).
Do you have any more information about what version of the runc package was tested and on what version of arch? What was the output of the module? What FILEDESCRIPTOR numbers were attempted? Are you sure the system is vulnerable?

There is a issue template for bugs, I would suggest following that as I'd like more information before expanding the module.

[h00die]

Metasploit folx, if someone can provide this technical writer a little guidance on what needs updating, then I'd be happy to update this for you.

I believe we chatted in slack, if this is incorrect please let me know.

[rolf-d2i]

Archlinux uses rolling updates and does not have versions, the system was update using pacman to the date I reported except runc that used the version specified. The runc version used should have made the system vulnerable as stated in the exploit description.