CVE-2019-5736 EXPLOIT

Description

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

Scoring

Affected (19)

Public exploits

References

• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html
• http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html
• http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html
• http://www.openwall.com/lists/oss-security/2019/03/23/1
• http://www.openwall.com/lists/oss-security/2019/06/28/2
• http://www.openwall.com/lists/oss-security/2019/07/06/3
• http://www.openwall.com/lists/oss-security/2019/07/06/4
• http://www.openwall.com/lists/oss-security/2019/10/24/1
• http://www.openwall.com/lists/oss-security/2019/10/29/3
• http://www.openwall.com/lists/oss-security/2024/01/31/6
• http://www.openwall.com/lists/oss-security/2024/02/01/1