What’s Vulnerable › Vulnerabilities

CVE-2019-5736

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 98.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-02-11 · updated 2026-06-17
• Weakness: CWE-78

Description

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

Affected products

• Apache Software Foundation Apache Mesos: from 1.4.0 before 1.4.3; from 1.5.0 before 1.5.3; from 1.6.0 before 1.6.2; from 1.7.0 before 1.7.2 — fixed in 1.4.3, 1.5.3, 1.6.2, 1.7.2
• Canonical Ubuntu Linux: 16.04, 18.04, 18.10, 19.04
• D2Iq Dc/Os: before 1.10.10; from 1.10.11 before 1.11.9; from 1.11.10 before 1.12.1 — fixed in 1.10.10, 1.11.9, 1.12.1
• D2Iq Kubernetes Engine: before 2.2.0-1.13.3 — fixed in 2.2.0-1.13.3
• Docker Engine: before 18.09.2 — fixed in 18.09.2
• Fedoraproject Fedora: 29, 30
• Google Kubernetes Engine: all versions
• HP Onesphere: all versions
• lxc: before 3.2.0 — fixed in 3.2.0
• opencontainers runc: through 0.1.1; 1.0.0-rc1, 1.0.0-rc2, 1.0.0-rc3, 1.0.0-rc4, 1.0.0-rc5, 1.0.0-rc6
• Micro Focus Service Management Automation: 2018.02, 2018.05, 2018.08, 2018.11
• NetApp Hci Management Node: all versions
• NetApp Solidfire: all versions
• openSUSE Backports Sle: 15.0, 15.0-sp1
• openSUSE Leap: 15.0, 15.1, 42.3
• RedHat Container Development Kit: 3.7
• Red Hat Enterprise Linux: 8.0
• RedHat Enterprise Linux Server: 7.0
• Openshift: 3.4, 3.5, 3.6, 3.7

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Mesos 1.4.3, 1.5.3, 1.6.2, 1.7.2; D2Iq Dc/Os 1.10.10, 1.11.9, 1.12.1; D2Iq Kubernetes Engine 2.2.0-1.13.3; Docker Engine 18.09.2; lxc 3.2.0. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html
• http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html
• http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html

Get alerted when CVE-2019-5736 or the next vulnerability affects your stack