Docker Patched the Most Severe Copy Vulnerability to Date With CVE-2019-14271
Summary: Unit 42 researchers documented CVE-2019-14271, a critical flaw in Docker's cp command that allows full container escape and root control of the host, fixed in Docker version 19.03.1. The bug stems from docker-tar chrooting into the container and then dynamically loading libnss libraries from the container filesystem while running in host namespaces with full root capabilities, so a malicious image or already-compromised container can execute code on the host when a user copies files out.
Key Takeaway: Exploitation requires only that a user run docker cp against a compromised or untrusted container, and the payoff is root on the host and every container on it. Running containers as a non-root user blocks it, because the attacker cannot overwrite the root-owned libnss libraries.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-14271
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026