Holistic-Deconstruction-of-CVE-2019-5736-

= doi.org/10.5281/zenodo.18304765 = orcid.org/0009-0007-7728-256X README.md 💀 CVE-2019-5736：runc 容器逃逸解构 高级紫队协作与宿主机 Root 逃逸取证分析 🛡️ 概述 本仓库包含针对 CVE-2019-5736 的高保真解构与概念验证（PoC）。CVE-2019-5736 是 runc（1.0-rc1 至 1.0-rc6 版本）中的一个严重漏洞。该漏洞允许拥有 root 权限的恶意容器覆盖宿主机上的 runc 二进制文件，从而获得完全的宿主机 root 访问权限 。 漏洞类型：...

CVE-2024-21626-demo

CVE-2024-21626-demo Container Runtime Meetup 5 的 LT 演示用。 基于公开信息旨在普及攻击风险，严禁滥用。 幻灯片 Container Runtime Meetup 5 ～那个镜像，真的可信吗？～ 使用 CVE-2024-21626 夺取宿主机的 root 权限 登录 victim-server 演示用笔记本电脑的 sshconfig 中注册为 victim-server 的机器。 root@kitploit: ssh victim-server 作为受害前提条件的版本信息: root@kitploit:...

CVE-2026-66897

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-66897 Instance template path traversal allows arbitrary host file write as root

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-66897

A path traversal vulnerability in LXD 's instance template processing allows an attacker with container edit permissions—or any user launching a crafted image—to overwrite arbitrary host files as root , achieving host-level code execution. The root cause is a discrepancy between path validation (...

CVE-2026-47243

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-47243 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host...

CVE-2026-47243

Kata Containers runtime-rs is affected by a guest-root to host-root escape in the virtio-fs path prior to version 3.31.0. In configurations using the host virtiofsd with --sandbox none and --seccomp none, a root-equivalent attacker inside the guest can bypass the guest virtio-fs client by taking ...

CVE-2026-44210

A flaw was found in Kata Containers, an open-source project that provides lightweight virtual machines VMs for containers. A user with privileges to create pods can inject malicious command-line arguments into the virtiofsd process, which manages shared file systems. This injection allows an...

CVE-2026-44210 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface CRI plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands o...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

EUVD-2026-39794

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640 LXD Snapshot Import Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

CVE-2026-9640 concerns LXD versions 6.0–6.9, 5.21.0–5.21.5, and 5.0.0–5.0.7. It describes a privilege escalation where an authenticated project operator in a restricted multi-tenant environment can bypass project-restriction policies during snapshot restoration by importing a malicious instance b...

CVE-2026-9640 LXD Snapshot Import Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-41567

A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the...

PT-2026-52844

Name of the Vulnerable Software and Affected Versions LXD versions 6.0 through 6.8 LXD versions 5.21.0 through 5.21.4 LXD versions 5.0.0 through 5.0.6 Description An issue exists in the handling of project-restriction policies during snapshot restoration. An authenticated project operator in a...

GO-2026-5758 containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd

containerd CRI — image-config LABEL flows to restart-monitor binary:// logger: host-root command execution from an image pull in github.com/containerd/containerd...