CVE-2019-5736

Usage Edit HOST inside payload.c, compile with make. Start nc and run pwn.sh inside the container. Notes This exploit is destructive: it'll overwrite /usr/bin/docker-runc binary on the host with the payload. It'll also overwrite /bin/sh inside the container. Tested only on Debian 9. No attempts...

CVE-2019-5736

CVE-2019-5736 Reference: cve-2019-5736-poc 1. edit poc command in stage2.cve 2. build docker docker build -t cve . 3. run docker docker run -d cve /bin/bash -c "tail -f /dev/null" 4. backup docker-runc cp /usr/bin/docker-runc /usr/bin/docker-runc.bak 5. docker exec -it docker-id /bin/bash 6. edit...

CVE-2019-5736-POC

Breaking out of Docker via RunC A proof of concept code for CVE-2019-5736 This POC is heavily based on YuvalAvra's POC. I do not claim any credit for the code utilised in this POC. More information about this vulnerability and a demonstration of how it can be exploited can be found in the...

CVE-2019-5736-PoC

CVE-2019-5736-PoC PoC for CVE-2019-5736 Created with help from @singe, @cablethief, and @feexd Tested on Ubuntu 18.04, Debian 9, and Arch Linux. Docker versions 18.09.1-ce and 18.03.1-ce. This PoC does not currently work with Ubuntu 16.04 and CentOS. Go checkout the exploit code from Dragon Secto...

cve-2019-5736-poc

To run: 1. edit poc command in stage2.c 2. build docker docker build -t cve . 3. run docker docker run -d cve /bin/bash -c "tail -f /dev/null" 4. backup docker-runc cp /usr/bin/docker-runc /usr/bin/docker-runc.bak 5. docker exec -it docker-id /bin/bash 6. in docker run cd /root && ./run.sh && exi...

cve-2024-21626-runc-1.1.11-escape

CVE-2024-21626 - runc Leaky Vessels Overview Field| Detail ---|--- CVE| CVE-2024-21626 Affected Component| runc ≤ 1.1.11 Vulnerability Class| Container escape via file descriptor leak Nickname| Leaky Vessels Root Cause runc leaks an internal file descriptor typically fd/7 pointing to the host...

CVE-2026-31431-Container-Escape

CVE-2026-31431 Container Escape Container escape via runC...

CVE-2026-31431-Copy-Fail-Container-Escape

CVE-2026-31431-Copy-Fail-Container-Escape Demo https://github.com/user-attachments/assets/2cb0cb67-789a-4461-a0b8-1fe878d9426e Prerequisite Container vulnerable to CVE-2026-31431 Container healthcheck configured and healthcheck CMD known Obtained root access inside the container if not, you can...

CVE-2024-21626

CVE-2024-21626 For detailed explanation for this vulnerability, plz refer to my article. Exploit Exploit via Running a Container No need to build a custom image, just run a container with -w parameter: docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm Exploit via Execin...

CVE-2026-D0cker

CVE-2026-Pending: Container Escape via runC maskPaths Vunlerability Severity: Critical CVSS 9.8 Component: opencontainers/runc libcontainer Vulnerability Type: CWE-59: Improper Link Resolution Before File Access 'Link Following' 🚨 Executive Summary A critical vulnerability exists in runc's...

CVE-2024-21626-PoC

CVE-2024-21626 Root cause & Proof of Concept How to use poc-autoplay? make install make uninstall 1. Root cause In runc versions ≤ 1.1.11, when opening the host's /sys/fs/cgroup directory to set cgroups, the file descriptor is left open for the container initialization process without closing it,...

CVE-2019-5736-Custom-Runtime

CVE-2019-5736-Custom-Sandbox General CVE-2019-5736 implemented using a shallow, self-written container runtime to understand the exploit. Exploit is based on and almost all copied from the runc-poc by twistlock: https://github.com/twistlock/RunC-CVE-2019-5736/tree/master/maliciousimagePOC Contain...

CVE-2024-21626-POC

CVE-2024-21626-POC Usage Instructions For educational/research purposes only. Any behavior not related to education/research is at your own risk. Usage docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh Start another terminal /bin/bash.copy Note Different docker/runc...

CVE-2019-5736-PoC-2

Overview The exploit from the following repository adapted to run in a Docker image. https://github.com/feexd/pocs Usage Building the Image $ git clone https://github.com/k-onishi/CVE-2019-5736-PoC $ cd CVE-2019-5736-PoC $ make $ sudo docker build -t poc . Execution Run the container and listen o...

cve-2019-5736-reproducer

CVE-2019-5736 reproducer This allows you to confirm RunC-CVE-2019-5736 works on your KVM instance. Workflow overview Build the docker.io related packages vulerable to CVE-2019-5736 in this repo Launch an Ubuntu 18.04 KVM instance on LXD Install the vulnerable .deb packages in the VM Try the...

Holistic-Deconstruction-of-CVE-2019-5736-

= doi.org/10.5281/zenodo.18304765 = orcid.org/0009-0007-7728-256X README.md 💀 CVE-2019-5736: runc Container Breakout Deconstruction Advanced Purple Teaming & Forensic Analysis of Host Root Escape 🛡️ Overview This repository contains a high-fidelity deconstruction and Proof-of-Concept PoC for...

cve-2019-5736-poc

CVE-2019-5736 Proof of Concept This appends a string to the host runc binary. Bring your own payload see stage2.c. To run: docker build -t cve . docker run cve strings /usr/bin/docker-runc | tail -n 2...

CVE-2024-21626

CVE-2024-21626 POC Requirements runc 1.1.0 /proc/self/cwd/../../../bin/bash.copy & /dev/tc...

proxmox-lxc-docker-fix

Proxmox LXC AppArmor Fix for Docker/Containers Workaround for CVE-2025-52881 : Fixes Docker, Podman, and container runtime breakage in Proxmox LXC containers caused by AppArmor incompatibility with runc 1.2.7+/1.3.2+ 🚨 The Problem Recent security updates to runc versions 1.2.7+ and 1.3.2+ and...

CVE-2024-21626

PoC of CVE-2024-21626 Read my full article for detailed explanation here. Related article While investigating CVE-2024–21626 , I discovered an overlooked vulnerability in older versions of Docker and runC. To learn more about what I found, read the following article: “Exploring Hidden...