cve-2019-5736-exp

cve-2019-5736-exp This is a proof-of-concept PoC exploit for the CVE-2019-5736 vulnerability in runc, the runtime used in Docker. Disclaimer I undertook this project as an exercise, for educational reasons and for fun. It should go without saying that I do not support unethical and/or illegal...

CVE-2024-21626-POC

CVE-2024-21626-PoC Usage Instructions For educational/research purposes only. Any use unrelated to education/research is at your own risk. Usage docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy Note The specific file descriptors used var...

CVE-2019-5736-PoC

Usage PoC was created to the scenario were victim is executing for example docker exec sh. Before running exploit it's required to overwrite sh binary in the container file system: printf '!/proc/self/exe' /bin/sh After that, when victim executes exec command, runc binary in the host file system...

POC-CVE-2019-5736

RunC-CVE-2019-5736 Video : https://bit.ly/2WqvILb Blog Post : www.idealhax.blogspot.com/2020/05/breaking-out-of-docker-via-runc.html Here, I like to mention that the original developer of this exploit is Yuval Avrahami at Twistlock Labs. Running the POCs Note that running the POCs will overwrite...

GHSA-MJCV-P78Q-W5FW vulnerabilities

Vulnerabilities for packages: docker, rke2-runtime, amazon-ecs-agent, neuvector, runc-fips, zarf-fips, chaos-mesh-fips, kubevirt-cdi-uploadserver, k3d, k3s, kubevirt-cdi-uploadserver-fips, ctop, cloudbeat, rancher-agent, chaos-mesh, gosu, vcluster-fips, neuvector-scanner,...

CVE-2026-61801 vulnerabilities

Vulnerabilities for packages: act, newrelic-infrastructure-agent, docker, gosu, neuvector-scanner, zarf, k3s, datadog-agent, scorecard, dagger, runc, vcluster, k3d, xeol, ctop, containerd, undock...

GHSA-MJCV-P78Q-W5FW vulnerabilities

Vulnerabilities for packages: act, newrelic-infrastructure-agent, docker, gosu, neuvector-scanner, zarf, k3s, datadog-agent, scorecard, dagger, runc, vcluster, k3d, xeol, ctop, containerd, undock...

CVE-2024-21262

RECORDS Only for reproduction of CVEs. Related Resources: LINK GITHUB1 GITHUB2 ISSUE Check Envs Download docker-24.0.6.tgz from https://download.docker.com/linux/static/stable/x8664/. sudo mkdir -p /usr/local/docker-24.0.6 sudo tar -xzf docker-24.0.6.tgz -C /usr/local/docker-24.0.6 sudo ln -sf...

CVE-2022-0847-container-escape

CVE-2022-0847 A simple exploit that uses dirtypipe to inject shellcode into runC entrypoint to implement container escapes. Usage Produce base64 encoded shellcode using msf: $ msfvenom -p linux/x64/exec CMD="" -f base64 Compile and run in the container, the overwritten filename is the bin that ru...

leaky-vessels-dynamic-detector

AVVISO Questo repository è ora archiviato. Non verranno più apportati aggiornamenti al codice e potrebbe essere insicuro o addirittura non funzionante nel momento in cui leggerai questo avviso. Consideralo solo per scopi storici e trattalo con cautela. Leaky Vessels Dynamic Detector In questo...

CVE-2024-21626

about Steps to reproduce ensure kernal = 5.4,4.19,.. and there is openat2 in /proc/kallsyms. v1.0.0-rc93= runc =1.1.11 $ grep openat2 /proc/kallsyms ffffffffa64290d0 T pfxauditopenat2how ffffffffa64290e0 T auditopenat2how ffffffffa666de90 t pfxdosysopenat2 ffffffffa666dea0 t dosysopenat2...

AlmaLinux 9.2 [TuxCare] Security Update: runc (ALMALINUX9.2:CLSA-2026:1791543621)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791543621 advisory. - Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each ste...

AZL-107862 CVE-2026-61801 affecting package runc 1.4.3-1

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

cve-2019-5736-poc

CVE-2019-5736 Prueba de Concepto Esto agrega una cadena al binario runc del host. Trae tu propio payload ver stage2.c. Para ejecutar: docker build -t cve . docker run cve strings /usr/bin/docker-runc | tail -n 2...

EulerOS 2.0 SP15 : docker-runc (EulerOS-SA-2026-3907)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : 'This is a PUBLIC release of a low-severity vulnerability in runc which\nhas been fixed in runc 1.3.6, runc 1.4.3, and runc 1.5.0-rc.3. There...

Astra Linux – Vulnerability in runc-app

Runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, as well as 1.3.0-rc.1 through 1.3.1, and 1.4.0-rc.1 and 1.4.0-rc.2, runc did not perform sufficient verification to ensure that the source of the bind-mount i.e., the container’...

Astra Linux – Vulnerability in runc-app

Runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, an attacker can trick runc into binding paths that are normally read-only or masked, allowing them to be...

Rocky Linux 8 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc (crlsa-2021_2371)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212371 advisory. runc: vulnerable to symlink exchange attack CVE-2021-30465 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 8.6 [CIQ] Security Update: runc / runc-debuginfo / runc-debugsource Multiple Vulnerabilities (ciqsa-2026_0850)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260850 advisory. This advisory aggregates security fixes for the runc SRPM in CIQ LTS 8.6. It addresses 37 CVEs: CVE-2021-36221, CVE-2021-41190, CVE-2022-1705,...

Rocky Linux 8 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc (crlsa-2021_2291)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212291 advisory. runc: vulnerable to symlink exchange attack CVE-2021-30465 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...