CVE-2019-5736
What it is
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
At a glance
- Exploitability
- Can be exploited locally on the machine without logging in, but needs a user to act. High risk of data exposure, data tampering, service disruption.
- Exploit odds
- 98.5% chance of exploitation in the next 30 days (EPSS). Higher than most.
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- ReservedThe CVE id was reserved by its CNA
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 98.5% in the next 30 days (EPSS).
- Severity: 8.6 HIGH (CVSS).
- Fix: a patch or advisory is linked.
Details
- Published
- Last modified
- Exploit probability
- 98.5% · EPSS, next 30 days
- Weakness
- CWE-78 · OS command injection
- Record status
- Modified
Affected
- Docker < 18.09.2
- Linuxfoundation Runc ≤ 0.1.1
- Linuxfoundation Runc 1.0.0
- Redhat Container Development Kit 3.7
- Redhat Openshift 3.4
- Redhat Openshift 3.5
- Redhat Openshift 3.6
- Redhat Openshift 3.7
Attack profile CVSS 3.1 · 8.6
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2019-5736.md and follow it. Check whether this project is affected by CVE-2019-5736. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
Fix and advisories
- https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/
- https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/
- https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html
- https://bugzilla.suse.com/show_bug.cgi?id=1121967
- https://github.com/docker/docker-ce/releases/tag/v18.09.2
- https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b
- https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d
- https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003
- https://www.openwall.com/lists/oss-security/2019/02/11/2
- https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/
References
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html
- http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html
- http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html
- http://www.openwall.com/lists/oss-security/2019/03/23/1
- http://www.openwall.com/lists/oss-security/2019/06/28/2
- http://www.openwall.com/lists/oss-security/2019/07/06/3
- http://www.openwall.com/lists/oss-security/2019/07/06/4
- http://www.openwall.com/lists/oss-security/2019/10/24/1
- http://www.openwall.com/lists/oss-security/2019/10/29/3
- http://www.openwall.com/lists/oss-security/2024/01/31/6
- http://www.openwall.com/lists/oss-security/2024/02/01/1
- http://www.openwall.com/lists/oss-security/2024/02/02/3
- http://www.securityfocus.com/bid/106976
- https://access.redhat.com/errata/RHSA-2019:0303
- https://access.redhat.com/errata/RHSA-2019:0304
- https://access.redhat.com/errata/RHSA-2019:0401