CVE-2026-13221: runc Container Runtime Remote Exploit — Detection & Hardening

---
title: Vulnerable Perl Version Installed on Container Host
id: 8a2b4c1d-9e3f-4a5b-8c6d-1e2f3a4b5c6d
status: experimental
description: Detects installations of Perl versions through 5.43.9 which are vulnerable to the regex overflow issue impacting runc.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13221
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.vulnerability_scanning
  - cve.2026.13221
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/perl'
    CommandLine|contains:
      - '--version'
  filter:
    # Logic would require parsing version output, this rule flags the check for manual verification or correlation
    # In a real scenario, correlate with configuration management data (CMDB) for exact versions.
    CommandLine|contains: 'version'
falsepositives:
  - Admin checking versions
level: medium
---
title: Suspicious Shell Spawn via runc
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of shells (sh/bash) directly spawned by runc or containerd-shim processes, indicating potential container escape or unauthorized command execution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13221
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.execution
  - attack.t1059.004
  - attack.privilege_escalation
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/runc'
      - '/containerd-shim'
      - '/docker-runc'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative container access (kubectl exec, docker exec)
level: high
---
title: Runc Execution Anomaly
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Identifies execution of the runc binary with unusual arguments potentially related to exploiting CVE-2026-13221.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13221
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/runc'
    CommandLine|contains:
      - '--root'
      - '--systemd-cgroup'
  condition: selection
falsepositives:
  - Normal container orchestration activities
level: low

// Hunt for vulnerable Perl version checks or unusual runc activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has "perl" 
| where ProcessCommandLine has "version"
| extend PerlVersion = extract(@'v?(\d+\.\d+\.\d+)', 1, ProcessCommandLine)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, PerlVersion
| distinct DeviceName, PerlVersion
| where PerlVersion <= "5.43.9" or isnull(PerlVersion) // Isnull implies version check was run, verify manually
| order by Timestamp desc
;
// Correlate with suspicious runc child processes
DeviceProcessEvents
| where InitiatingProcessFileName has_any ("runc", "containerd-shim")
| where FileName in~ ("sh", "bash", "dash", "zsh")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName

-- Hunt for vulnerable Perl versions and runc processes
SELECT 
  OSPath,
  Size,
  Mode,
  Mtime
FROM glob(globs='/usr/bin/perl', '/usr/local/bin/perl')
WHERE OSPath = "/usr/bin/perl" OR OSPath = "/usr/local/bin/perl"
-- Note: VQL can execute binary to get version if exec available, otherwise use file metadata for correlation
;
SELECT Pid, Ppid, Name, Exe, Username, CommandLine
FROM pslist()
WHERE Name =~ 'runc' OR Name =~ 'containerd'

#!/bin/bash

# Remediation Script for CVE-2026-13221
# Checks for vulnerable Perl versions and runc presence

echo "[+] Checking for runc installation..."
if command -v runc &> /dev/null; then
    echo "[!] runc is installed at: $(which runc)"
    runc -v
else
    echo "[-] runc not found."
fi

echo ""
echo "[+] Checking Perl version (Vulnerable: <= 5.43.9)..."
if command -v perl &> /dev/null; then
    PERL_VERSION=$(perl -e 'print $^V;')
    # perl returns e.g. v5.38.2
    MAJOR=$(echo $PERL_VERSION | cut -d'v' -f2 | cut -d'.' -f1)
    MINOR=$(echo $PERL_VERSION | cut -d'v' -f2 | cut -d'.' -f2)
    PATCH=$(echo $PERL_VERSION | cut -d'v' -f2 | cut -d'.' -f3)

    echo "[*] Detected Perl Version: $PERL_VERSION"

    # Basic string comparison for version check (simplified for script)
    # In production, use sort -V or python for robust version checking
    VULNERABLE=false
    if [ "$MAJOR" -lt 5 ]; then
        VULNERABLE=true
    elif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -lt 44 ]; then 
        # Since 5.43.9 is vulnerable, anything < 5.44 is suspect, check patch if needed strictly
        # Here we assume 5.44.0+ is safe based on "through 5.43.9" wording
        VULNERABLE=true
    fi

    if [ "$VULNERABLE" = true ]; then
        echo "[!] ALERT: Vulnerable Perl version detected. Please update to > 5.43.9."
        echo "[!] Action required: Update Perl and restart container services."
        exit 1
    else
        echo "[+] Perl version appears safe."
    fi
else
    echo "[-] Perl not found."
fi

echo "[+] Done."