CVE-2019-5736

8.6HIGH

Key Information

Vendor
Docker
Status
Docker
Vendor
CVE Published:
11 February 2019

Badges

👾 Exploit Exists🟡 Public PoC

Summary

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-5736-PoC
Created by Frichetten

cve-2019-5736-poc
Created by q3k

RunC-CVE-2019-5736
Created by twistlock

References

https://github.com/opencontainers/runc/commit/6635b4f0c6a...
https://access.redhat.com/errata/RHSA-2019:0408
vendor-advisory
https://github.com/rancher/runc-cve

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database23 Proof of Concept(s)
.