Holistic-Deconstruction-of-CVE-2019-5736-

= doi.org/10.5281/zenodo.18304765 = orcid.org/0009-0007-7728-256X README.md 💀 CVE-2019-5736: runc Container Breakout Deconstruction Advanced Purple Teaming & Forensic Analysis of Host Root Escape 🛡️ Overview This repository contains a high-fidelity deconstruction and Proof-of-Concept PoC for...

CVE-2024-21626-demo

CVE-2024-21626-demo Demo for the LT at Container Runtime Meetup 5. This is to raise awareness of the attack risk based on publicly known information, and misuse is strictly prohibited. Slides Container Runtime Meetup 5 - Can You Really Trust That Image? Taking Host Root with CVE-2024-21626 Loggin...

Zapscape-Fix

Zapscape-Fix — CVE-2026-64561 KVM 内核热补丁 English | 简体中文 给 CentOS Stream 8 / RHEL 8 （4.18.0 全系列内核）的 KVM 宿主机修复 CVE-2026-64561（Zapscape） 漏洞的内核热补丁 ： 不打补丁的风险 ：租户虚拟机（guest）可以仅凭自身操作逃逸到宿主机，以宿主 内核 root 权限执行代码——击穿整台物理机及其上所有虚拟机。 本项目的补丁 ：基于 Linux 上游官方修复（2abd5287f083）backport 而来， 通过内核 livepatch 机制在线生效 ： ✅ 不重启宿...

Linux Distros Unpatched Vulnerability : CVE-2026-66897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, ...

DEBIAN-CVE-2026-66897

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-66897

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-66897

A path traversal vulnerability in LXD 's instance template processing allows an attacker with container edit permissions—or any user launching a crafted image—to overwrite arbitrary host files as root , achieving host-level code execution. The root cause is a discrepancy between path validation (...

CVE-2026-47243

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-47243

Kata Containers runtime-rs is affected by a guest-root to host-root escape in the virtio-fs path prior to version 3.31.0. In configurations using the host virtiofsd with --sandbox none and --seccomp none, a root-equivalent attacker inside the guest can bypass the guest virtio-fs client by taking ...

CVE-2026-44210

A flaw was found in Kata Containers, an open-source project that provides lightweight virtual machines VMs for containers. A user with privileges to create pods can inject malicious command-line arguments into the virtiofsd process, which manages shared file systems. This injection allows an...

CVE-2026-44210 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface CRI plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands o...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

EUVD-2026-39794

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640 LXD Snapshot Import Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

CVE-2026-9640 concerns LXD versions 6.0–6.9, 5.21.0–5.21.5, and 5.0.0–5.0.7. It describes a privilege escalation where an authenticated project operator in a restricted multi-tenant environment can bypass project-restriction policies during snapshot restoration by importing a malicious instance b...

CVE-2026-9640 LXD Snapshot Import Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...