Attacking Containers and runC

🗓️ 12 Feb 2019 19:22:35Reported by Mark Nunnikhoven (Vice President, Cloud Research)Type

trendmicroblog🔗 blog.trendmicro.com👁 95 Views

A new vulnerability ([CVE-2019-5736](<https://nvd.nist.gov/vuln/detail/CVE-2019-5736>)) highlights container security weakness, allowing attackers to manipulate runC and take control of the host

Reporter	Title	Published	Views	Family All 372
zdt	runC < 1.0-rc6 (Docker < 18.09.2) - Host Command Execution Exploit	12 Feb 201900:00	–	zdt
zdt	runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)	15 Feb 201900:00	–	zdt
zdt	Docker Container Escape Exploit	1 Jul 202100:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Cloud Private for Data is affected by an issue with runc used by Docker	3 Oct 201922:50	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Docker affects PowerKVM	17 May 201916:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Private is affected by an issue with runc used by Docker	3 Nov 202122:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local	20 Dec 201913:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Functions is affected by a privilege escalation vulnerability in runc	18 Feb 201920:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is affected by a critical vulnerability in Kubernetes via runc (CVE-2019-5736)	5 Mar 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a privilege escalation vulnerability in runc	18 Feb 201919:10	–	ibm

12 Feb 2019 19:22Current

8.9High risk

Vulners AI Score8.9

EPSS0.98452