Privilege escalation in runc - CVE-2019-5736

Vulnerability identifier: #VU17474

CSH Severity: Medium

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-5736

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists in the runc container runtime due to file-descriptor mishandling, related to /proc/self/exe. A remote attacker can leverage the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec, overwrite the host runc binary with minimal user interaction and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

runc
Arch Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
SUSE Linux Enterprise Module for Containers
SUSE Linux
Opensuse
openEuler
Fedora
IBM Cloud Automation Manager
runc (Alpine package)
flatpak (Alpine package)
runc
runc-debuginfo
flatpak
containerd
docker-latest
docker
lxc
lxcfs
python3-lxc
moby-engine
docker-debuginfo
vCloud Director Container Service Extension
vSphere Integrated Containers
VMware PKS
Integrated OpenStack

To prevent this attack, LXC has been patched to create a temporary copy of the calling binary itself when it starts or attaches to containers (cf. 6400238d08cdf1ca20d49bafb85f4e224348bf9d).

runc (Alpine package) - addressed in versions 1.0.0_rc6-r1, 1.0.0_rc8-r2, 1.0.0_rc91-r0
vCloud Director Container Service Extension - update to 1.2.7
flatpak (Alpine package) - update to 1.0.7-r0
VMware PKS - addressed in versions 1.2.9, 1.3.2
runc - update to 1.0.0~rc93-16.8.1
runc-debuginfo - update to 1.0.0~rc93-16.8.1
runc - addressed in versions 1.0.0-68.dev.git6635b4f.fc28, 1.0.0-68.dev.git6635b4f.fc29, 1.0.0-92.dev.gitc1b8c57.fc29, 1.0.0-92.dev.gitc1b8c57.fc30
flatpak - addressed in versions 1.0.7-1.fc28, 1.2.3-1.fc29
containerd - update to 1.4.4-16.38.1
docker-latest - update to 1.13.1-42.git1185cfd.fc29
docker - addressed in versions 1.13.1-65.git1185cfd.fc28, 1.13.1-65.git1185cfd.fc29
lxc - addressed in versions 3.0.4-1.fc29, 3.0.4-1.fc30
lxcfs - addressed in versions 3.0.4-1.fc29, 3.0.4-1.fc30
python3-lxc - addressed in versions 3.0.4-1.fc29, 3.0.4-1.fc30
lxc - update to 4.0.1-2020052701
moby-engine - addressed in versions 18.06.0-2.ce.git0ffa825.fc28, 18.06.0-2.ce.git0ffa825.fc29
docker-debuginfo - update to 20.10.6_ce-98.66.1
docker - update to 20.10.6_ce-98.66.1

• Exploit #8765 - Docker-Vulnerabilities-CVE-2019-5736 (Docker container vulnerabilities exploiting CVE-2019-5736 ) (January 23, 2023)
• Exploit #6488 - Docker Container Escape Via runC Overwrite (June 30, 2021)
• Exploit #6087 - runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2) (June 17, 2021)
• Exploit #2014 - Docker-Runc-Exploit (Docker runc CVE-2019-5736 exploit Dockerfile. Credits : https://github.com/Frichetten/CVE-2019-5736-PoC.git) (March 18, 2020)
• Exploit #2068 - Docker-Escape-Miner (Code sample for using exploit CVE-2019-5736 to mine bitcoin with no association to original container or user.) (March 18, 2020)
• Exploit #231 - CVE-2019-5736-Custom-Runtime (CVE-2019-5736 implemented in a self-written container runtime to understand the exploit.) (March 18, 2020)

• https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/
• https://brauner.github.io/2019/02/12/privileged-containers.html
• https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b
• https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d
• https://github.com/Frichetten/CVE-2019-5736-PoC

• Privilege escalation in runc
• Amazon Linux AMI update for docker
• Arch Linux update for runc
• OpenSUSE Linux update for runc
• Privilege escalation in VMware Integrated OpenStack with Kubernetes and vSphere Integrated Container
• Privilege escalation in VMware PKS and vCloud Director Container Service Extension
• Arch Linux update for flatpak
• OpenSUSE Linux update for docker-runc
• OpenSUSE Linux update for runc
• OpenSUSE Linux update for lxc
• OpenSUSE Linux update for lxc
• OpenSUSE Linux update for containerd
• OpenSUSE Linux update for docker-runc
• OpenSUSE Linux update for containerd
• OpenSUSE Linux update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork
• OpenSUSE Linux update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork
• OpenSUSE Linux update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork
• Red Hat update for runc
• Red Hat update for docker
• Red Hat update for container-tools:rhel8
• OpenSUSE Linux update for lxc
• OpenSUSE Linux update for lxc
• Gentoo update for runC
• Privilege escalation in runc (Alpine package)
• Privilege escalation in flatpak (Alpine package)
• SUSE update for containerd, docker, runc
• Multiple vulnerabilities in IBM Cloud Automation Manager
• openEuler 20.03 LTS update for lxc-4.0.1-2020052701
• Fedora 29 update for flatpak
• Fedora 29 update for moby-engine
• Fedora 28 update for moby-engine
• Fedora 28 update for flatpak
• Fedora 29 update for runc
• Fedora 28 update for runc
• Fedora 29 update for docker
• Fedora 28 update for docker
• Fedora 29 update for docker-latest
• Fedora 30 update for runc
• Fedora 29 update for runc
• Fedora 30 update for lxc, lxcfs, python3-lxc
• Fedora 29 update for lxc, lxcfs, python3-lxc