Breaking out of Docker via runC – Explaining CVE-2019-5736
Summary: A runC vulnerability reported on 2019-02-11, CVE-2019-5736, was found by Adam Iwaniuk and Borys Poplawski and affects Docker containers running in default settings, allowing an attacker to overwrite the host runC binary and gain root-level access on the host. The same flaw existed in LXC, though only privileged LXC containers were vulnerable, and both runC and LXC were patched with new versions released.
What's compelling: The exploit requires only root access inside a container and minimal user interaction, and once runC is overwritten the next execution yields root code execution on the host - which is why the runC team released its own exploit code on 2019-02-13, five days ahead of the planned 2019-02-18 date, after others published theirs.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5736
- Related
- Breaking Out of rkt – 3 New Unpatched CVEs Cyber Risks ·