CVE-2019-5736
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host roo…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)2019-02-13 · local · linux
- runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (1)2019-02-12 · local · linux
Impact
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Docker | Docker | before 18.09.2 |
| Linuxfoundation | Runc | through 0.1.1 Version 1.0.0 |
| Redhat | Container Development Kit | Version 3.7 |
| Redhat | Openshift | Versions 3.4, 3.5, 3.6, 3.7 |
| Redhat | Enterprise Linux | Version 8.0 |
| Redhat | Enterprise Linux Server | Version 7.0 |
| Kubernetes Engine | All versions | |
| Linuxcontainers | Lxc | before 3.2.0 |
| Hp | Onesphere | All versions |
| Netapp | Hci Management Node | All versions |
| Netapp | Solidfire | All versions |
| Apache | Mesos | from 1.4.0 before 1.4.3 from 1.5.0 before 1.5.3 from 1.6.0 before 1.6.2 from 1.7.0 before 1.7.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html
- http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html
- http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html
- http://www.openwall.com/lists/oss-security/2019/03/23/1
- http://www.openwall.com/lists/oss-security/2019/06/28/2
- http://www.openwall.com/lists/oss-security/2019/07/06/3
- http://www.openwall.com/lists/oss-security/2019/07/06/4
- http://www.openwall.com/lists/oss-security/2019/10/24/1
- http://www.openwall.com/lists/oss-security/2019/10/29/3
- http://www.openwall.com/lists/oss-security/2024/01/31/6
- http://www.openwall.com/lists/oss-security/2024/02/01/1
- http://www.openwall.com/lists/oss-security/2024/02/02/3
- http://www.securityfocus.com/bid/106976
- https://access.redhat.com/errata/RHSA-2019:0303
- https://access.redhat.com/errata/RHSA-2019:0304
- https://access.redhat.com/errata/RHSA-2019:0401