CVE-2019-5736

Published: Feb 11, 2019Modified: Jun 17, 2026

8.6

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 6.0

Source: NVD

Description

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

Affected (43)

Products: Docker: Docker · Linuxfoundation: Runc · Redhat: Container Development Kit, Enterprise Linux, Enterprise Linux Server, Openshift · +10 more

Show all products

Docker: Docker · Linuxfoundation: Runc · Redhat: Container Development Kit, Enterprise Linux, Enterprise Linux Server, Openshift · Google: Kubernetes Engine · Linuxcontainers: Lxc · Hp: Onesphere · Netapp: Hci Management Node, Solidfire · Apache: Mesos · Opensuse: Backports Sle, Leap · D2iq: Dc/os, Kubernetes Engine · Fedoraproject: Fedora · Canonical: Ubuntu Linux · Microfocus: Service Management Automation

1 product

1 product

4 products

Container Development Kit

Enterprise Linux

Enterprise Linux Server

1 product

1 product

1 product

2 products

1 product

2 products

2 products

1 product

1 product

1 product

Service Management Automation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Docker Docker	Before 18.09.2

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Runc	Up to 0.1.1
Linuxfoundation Runc	Version 1.0.0 rc1
Linuxfoundation Runc	Version 1.0.0 rc2
Linuxfoundation Runc	Version 1.0.0 rc3
Linuxfoundation Runc	Version 1.0.0 rc4
Linuxfoundation Runc	Version 1.0.0 rc5
Linuxfoundation Runc	Version 1.0.0 rc6

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Container Development Kit	Version 3.7
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Openshift	Version 3.4
Redhat Openshift	Version 3.5
Redhat Openshift	Version 3.6
Redhat Openshift	Version 3.7

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Google Kubernetes Engine	All versions

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Linuxcontainers Lxc	Before 3.2.0

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Hp Onesphere	All versions

Configuration G

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Hci Management Node	All versions
Netapp Solidfire	All versions

Configuration H

4 vulnerable

Vulnerable Software	Affected Versions
Apache Mesos	From 1.4.0 to 1.4.3
Apache Mesos	From 1.5.0 to 1.5.3
Apache Mesos	From 1.6.0 to 1.6.2
Apache Mesos	From 1.7.0 to 1.7.2

Configuration I

5 vulnerable

Vulnerable Software	Affected Versions
Opensuse Backports Sle	Version 15.0
Opensuse Backports Sle	Version 15.0 sp1
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1
Opensuse Leap	Version 42.3

Configuration J

4 vulnerable

Vulnerable Software	Affected Versions
D2iq Dc/os	Before 1.10.10
D2iq Dc/os	From 1.10.11 to 1.11.9
D2iq Dc/os	From 1.11.10 to 1.12.1
D2iq Kubernetes Engine	Before 2.2.0-1.13.3

Configuration K

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30

Configuration L

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10
Canonical Ubuntu Linux	Version 19.04

Configuration M

4 vulnerable

Vulnerable Software	Affected Versions
Microfocus Service Management Automation	Version 2018.02
Microfocus Service Management Automation	Version 2018.05
Microfocus Service Management Automation	Version 2018.08
Microfocus Service Management Automation	Version 2018.11

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (132)

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2019/03/23/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/06/28/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/07/06/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/07/06/4

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/10/24/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/10/29/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2024/01/31/6

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2024/02/01/1

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2024/02/02/3

Source: cve@mitre.org

http://www.securityfocus.com/bid/106976

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2019:0303

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0304

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0401

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0408

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0975

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/security/cve/cve-2019-5736

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/security/vulnerabilities/runcescape

Source: cve@mitre.org

Third Party Advisory

https://aws.amazon.com/security/security-bulletins/AWS-2019-002/

Source: cve@mitre.org

Third Party Advisory

https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/

Source: cve@mitre.org

PatchThird Party AdvisoryVendor Advisory

https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/

Source: cve@mitre.org

PatchThird Party AdvisoryVendor Advisory

https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html

Source: cve@mitre.org

ExploitMitigationThird Party Advisory

https://brauner.github.io/2019/02/12/privileged-containers.html

Source: cve@mitre.org

ExploitTechnical DescriptionThird Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1121967

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc

Source: cve@mitre.org

Third Party Advisory

https://github.com/Frichetten/CVE-2019-5736-PoC

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/docker/docker-ce/releases/tag/v18.09.2

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/q3k/cve-2019-5736-poc

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/rancher/runc-cve

Source: cve@mitre.org

Third Party Advisory

https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/

Source: cve@mitre.org

Third Party Advisory

https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3%40%3Cdev.dlab.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706%40%3Cuser.mesos.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46%40%3Cdev.dlab.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e%40%3Cdev.dlab.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587%40%3Cdev.dlab.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202003-21

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190307-0008/

Source: cve@mitre.org

Third Party Advisory

https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944

Source: cve@mitre.org

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_us

Source: cve@mitre.org

Permissions Required

https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003

Source: cve@mitre.org

ExploitPatchThird Party Advisory

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4048-1/

Source: cve@mitre.org

Third Party Advisory

https://www.exploit-db.com/exploits/46359/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/46369/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://www.openwall.com/lists/oss-security/2019/02/11/2

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://www.synology.com/security/advisory/Synology_SA_19_06

Source: cve@mitre.org

Third Party Advisory

https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html