CVE-2019-5736 in the critical feed json
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and conseque…
published 2019-02-11 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-15309
- cvss
- 8.6
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 98.5%
- EPSS 98.5% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 3
- Metasploit, Exploit-DB
Summary
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
Patch / fix
- docker docker 18.09.2
- linuxcontainers lxc 3.2.0
- apache mesos 1.4.3, 1.5.3, 1.6.2, 1.7.2
- d2iq kubernetes_engine 2.2.0-1.13.3
- d2iq dc/os 1.10.10, 1.11.9, 1.12.1
- lxc Debian 14, Debian 13, Debian 12 1:3.1.0+really3.0.3-4
- runc Debian 14, Debian 13, Debian 12 1.0.0~rc6+dfsg1-2
debian advisories DEBIAN-CVE-2019-5736
- runc Ubuntu 16.04 LTS 1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.1
- runc Ubuntu 18.04 LTS 1.0.0~rc4+dfsg1-6ubuntu0.18.04.1
- docker.io Ubuntu 16.04 LTS 18.06.1-0ubuntu1.2~16.04.1
- docker.io Ubuntu 18.04 LTS 18.06.1-0ubuntu1.2~18.04.1
ubuntu advisories UBUNTU-CVE-2019-5736
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- docker RHEL 7 EXTRAS_OTHER 2:1.13.1-91.git07f3374.el7
- docker-client RHEL 7 EXTRAS_OTHER 2:1.13.1-91.git07f3374.el7
- docker-common RHEL 7 EXTRAS_OTHER 2:1.13.1-91.git07f3374.el7
- docker-logrotate RHEL 7 EXTRAS_OTHER 2:1.13.1-91.git07f3374.el7
- docker-lvm-plugin RHEL 7 EXTRAS_OTHER 2:1.13.1-91.git07f3374.el7
- docker-v1.10-migrator RHEL 7 EXTRAS_OTHER 2:1.13.1-91.git07f3374.el7
- docker-novolume-plugin RHEL 7 EXTRAS_OTHER 2:1.13.1-91.git07f3374.el7
- docker-rhel-push-plugin RHEL 7 EXTRAS_OTHER 2:1.13.1-91.git07f3374.el7
red hat advisories RHSA-2019:0304RHSA-2019:0303RHSA-2019:0975RHSA-2019:0408
- runc SLE Module for Containers 12 1.0.0~rc93-16.8.1
- docker SLE Module for Containers 12 20.10.6_ce-98.66.1
- containerd SLE Module for Containers 12 1.4.4-16.38.1
- golang-github-docker-libnetwork SLE Module for Containers 12, OpenStack Cloud 6-LTSS 0.7.0.1+gitr2800_fc5a7d91d54c-25.1
- docker SLE Module for Containers 12, OpenStack Cloud 6-LTSS 19.03.1_ce-98.46.1
- containerd SLE Module for Containers 12, OpenStack Cloud 6-LTSS 1.2.6-16.23.1
- docker-runc SLE Module for Containers 12, OpenStack Cloud 6-LTSS 1.0.0rc8+gitr3826_425e105d5a03-1.29.1
- golang-github-docker-libnetwork SLE Module for Containers 15 SP1, SLE Module for Containers 15 0.7.0.1+gitr2800_fc5a7d91d54c-4.15.1
suse advisories SUSE-SU-2021:1458-1SUSE-SU-2019:2119-1SUSE-SU-2019:2117-1SUSE-SU-2019:1234-2SUSE-SU-2019:1234-1SUSE-SU-2019:0573-1
- containerd openSUSE Tumbleweed 1.4.8-2.2
- flatpak openSUSE Tumbleweed 1.11.3-1.2
- lxc openSUSE Tumbleweed 4.0.9-1.1
- runc openSUSE Tumbleweed 1.0.2-1.2
- lxc Package Hub 15 SP1 3.2.1-bp151.5.3.1
- lxc openSUSE Leap 15.1 3.2.1-lp151.4.5.1
- golang-github-docker-libnetwork openSUSE Leap 15.1, openSUSE Leap 15.0 0.7.0.1+gitr2800_fc5a7d91d54c-lp151.2.6.1
- docker openSUSE Leap 15.1, openSUSE Leap 15.0 19.03.1_ce-lp151.2.12.1
opensuse advisories openSUSE-SU-2024:10693-1openSUSE-SU-2024:10762-1openSUSE-SU-2024:11030-1openSUSE-SU-2024:11358-1openSUSE-SU-2019:2286-1openSUSE-SU-2019:2245-1
- oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082
- oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43
- oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43
- oci-systemd-hook AlmaLinux 8 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
- oci-systemd-hook AlmaLinux 8 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43
- oci-systemd-hook AlmaLinux 8 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43
almalinux advisories ALSA-2019:0975
- oci-umount Rocky Linux 8 2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f
- oci-systemd-hook Rocky Linux 8 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f
rocky linux advisories RLSA-2019:0975
- lxc Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 3.1.0-r1
- runc Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 1.0.0_rc7-r0
- runc Alpine 3.11 1.0.0_rc7
- runc Alpine 3.9 1.0.0_rc6-r1
- flatpak Alpine 3.9 1.0.7-r0
alpine advisories ALPINE-CVE-2019-5736
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- github.com/opencontainers/runc@6635b4f commit
- github.com/opencontainers/runc@0a8e411 commit
- github.com/docker/docker-ce/releases/tag/v18.09.2 release
- openwall.com/lists/oss-security/2019/02/11/2 advisory
- azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/ advisory
- azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/ advisory
- bugzilla.suse.com/show_bug.cgi?id=1121967 advisory
- support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH… advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-5736 updated cvss 7.7
runc: Execution of malicious containers allows for container escape and access to host filesystem
-
Red Hat Enterprise Linux 7 docker-latest Red Hat OpenShift Container Platform 3.9 runcaffected: workaround, no fix planned “This vulnerability is mitigated on Red Hat Enterprise Linux 7 if SELinux is in enforcing mode. SELinux in enforcing mode is a pre-requisite for OpenShift Container Platform 3.x.”
-
Red Hat Container Development Kitfixed: vendor fix “This vulnerability is mitigated on Red Hat Enterprise Linux 7 if SELinux is in enforcing mode. SELinux in enforcing mode is a pre-requisite for OpenShift Container Platform 3.x.” RHSA-2019:0401
-
Red Hat Enterprise Linux 7 Extras docker 1.13.1-91.git07f3374.el7, runc 1.0.0-59.dev.git2abd837.el7, docker-client 1.13.1-91.git07f3374.el7, docker-common 1.13.1-91.git07f3374.el7, docker-logrotate 1.13.1-91.git07f3374.el7, docker-lvm-plugin 1.13.1-91.git07f3374.el7, +3 morefixed: vendor fix “This vulnerability is mitigated on Red Hat Enterprise Linux 7 if SELinux is in enforcing mode. SELinux in enforcing mode is a pre-requisite for OpenShift Container Platform 3.x.” RHSA-2019:0304
-
Red Hat Enterprise Linux AppStream (v. 8) fuse-overlayfs 0.3-2.module+el8.0.0+2958+4e823551, buildah 1.5-3.gite94b4f9.module+el8.0.0+2958+4e823551, podman 1.0.0-2.git921f98f.module+el8.0.0+2958+4e823551, skopeo 0.1.32-3.git1715c90.module+el8.0.0+2958+4e823551, oci-umount 2.3.4-2.git87f9237.module+el8.0.0+2958+4e823551, podman-docker 1.0.0-2.git921f98f.module+el8.0.0+2958+4e823551, +6 morefixed: vendor fix “This vulnerability is mitigated on Red Hat Enterprise Linux 7 if SELinux is in enforcing mode. SELinux in enforcing mode is a pre-requisite for OpenShift Container Platform 3.x.” RHSA-2019:0975
-
Red Hat OpenShift Container Platform 3.4 docker 1.12.6-79.git5680db5.el7, docker-client 1.12.6-79.git5680db5.el7, docker-common 1.12.6-79.git5680db5.el7, docker-logrotate 1.12.6-79.git5680db5.el7, docker-unit-test 1.12.6-79.git5680db5.el7, docker-lvm-plugin 1.12.6-79.git5680db5.el7, +3 more Red Hat OpenShift Container Platform 3.5 docker 1.12.6-79.git5680db5.el7, docker-client 1.12.6-79.git5680db5.el7, docker-common 1.12.6-79.git5680db5.el7, docker-logrotate 1.12.6-79.git5680db5.el7, docker-unit-test 1.12.6-79.git5680db5.el7, docker-lvm-plugin 1.12.6-79.git5680db5.el7, +3 more Red Hat OpenShift Container Platform 3.6 docker 1.12.6-79.git5680db5.el7, docker-client 1.12.6-79.git5680db5.el7, docker-common 1.12.6-79.git5680db5.el7, docker-logrotate 1.12.6-79.git5680db5.el7, docker-unit-test 1.12.6-79.git5680db5.el7, docker-lvm-plugin 1.12.6-79.git5680db5.el7, +3 more Red Hat OpenShift Container Platform 3.7 docker 1.12.6-79.git5680db5.el7, docker-client 1.12.6-79.git5680db5.el7, docker-common 1.12.6-79.git5680db5.el7, docker-logrotate 1.12.6-79.git5680db5.el7, docker-unit-test 1.12.6-79.git5680db5.el7, docker-lvm-plugin 1.12.6-79.git5680db5.el7, +3 morefixed: vendor fix “This vulnerability is mitigated on Red Hat Enterprise Linux 7 if SELinux is in enforcing mode. SELinux in enforcing mode is a pre-requisite for OpenShift Container Platform 3.x.” RHSA-2019:0408
-
Red Hat Enterprise Linux 8 runc Red Hat Enterprise Linux Atomic Host 7 runc, docker Red Hat OpenShift Container Platform 4 runcnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (Metasploit exploit/linux/local/docker_runc_escape)
- Published
Exploit prediction
98.45% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/local/docker_runc_escape Docker Container Escape Via runC Overwrite metasploit exploit, manual rank, 2019-01-01
- EDB-46369 runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2) local, 2019-02-13
- EDB-46359 runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (1) local, 2019-02-12
- support.mesosphere.com https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003 referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/q3k/cve-2019-5736-poc referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/Frichetten/CVE-2019-5736-PoC referenced PoC, tagged "exploit" by a source, unverified
- brauner.github.io https://brauner.github.io/2019/02/12/privileged-containers.html referenced PoC, tagged "exploit" by a source, unverified
- packetstormsecurity.com http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html referenced PoC, tagged "exploit" by a source, unverified
- blog.dragonsector.pl https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
- Technology feeds
References
-
github.com
/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d
patch, third-party-advisory
-
github.com
/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b
patch, third-party-advisory
-
openwall.com
/lists/oss-security/2019/02/11/2
mailing-list, patch, third-party-advisory
-
azure.microsoft.com
/en-us/updates/cve-2019-5736-and-runc-vulnerability/
patch, third-party-advisory, vendor-advisory
-
azure.microsoft.com
/en-us/updates/iot-edge-fix-cve-2019-5736/
patch, third-party-advisory, vendor-advisory
-
bugzilla.suse.com
/show_bug.cgi?id=1121967
issue-tracking, patch, third-party-advisory
-
support.mesosphere.com
/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003
exploit, patch, third-party-advisory
-
exploit-db.com
/exploits/46359/
exploit, third-party-advisory, vdb-entry
-
exploit-db.com
/exploits/46369/
exploit, third-party-advisory, vdb-entry
-
github.com
/q3k/cve-2019-5736-poc
exploit, third-party-advisory
-
github.com
/Frichetten/CVE-2019-5736-PoC
exploit, third-party-advisory
-
brauner.github.io
/2019/02/12/privileged-containers.html
exploit, technical-description, third-party-advisory
-
packetstormsecurity.com
/files/163339/Docker-Container-Escape.html
exploit, third-party-advisory, vdb-entry
-
blog.dragonsector.pl
/2019/02/cve-2019-5736-escape-from-docker-and.html
exploit, mitigation, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:0408
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:0401
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2019:0303
vendor-advisory, third-party-advisory
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:0304
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-03/msg00044.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-04/msg00074.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-04/msg00091.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:0975
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-05/msg00060.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-05/msg00073.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-06/msg00011.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-06/msg00015.html
vendor-advisory, mailing-list, third-party-advisory
-
usn.ubuntu.com
/4048-1/
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-08/msg00084.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-10/msg00007.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-10/msg00029.html
vendor-advisory, mailing-list, third-party-advisory
-
security.gentoo.org
/glsa/202003-21
vendor-advisory
- github.com /rancher/runc-cve
- github.com /docker/docker-ce/releases/tag/v18.09.2
- synology.com /security/advisory/Synology_SA_19_06
- security.netapp.com /advisory/ntap-20190307-0008/
- aws.amazon.com /security/security-bulletins/AWS-2019-002/
- kubernetes.io /blog/2019/02/11/runc-and-cve-2019-5736/
- access.redhat.com /security/cve/cve-2019-5736
- support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_us
- twistlock.com /2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/
- cloud.google.com /kubernetes-engine/docs/security-bulletins#february-11-2019-runc
-
packetstormsecurity.com
/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html
third-party-advisory, vdb-entry
-
openwall.com
/lists/oss-security/2019/03/23/1
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2019/06/28/2
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2019/07/06/3
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2019/07/06/4
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2019/10/24/1
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2019/10/29/3
mailing-list, third-party-advisory
- openwall.com /lists/oss-security/2024/01/31/6
- openwall.com /lists/oss-security/2024/02/01/1
- openwall.com /lists/oss-security/2024/02/02/3
-
securityfocus.com
/bid/106976
third-party-advisory, vdb-entry
Sources
- CVE List CVE-2019-5736
- NVD CVE-2019-5736
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.