{"id":"CVE-2019-5736","published":"2019-02-11T00:00:00Z","modified":"2024-08-04T20:01:52Z","title":"runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a file-descriptor mishandling issue, tied to /proc/self/exe, in runc through 1.0-rc6 as used in Docker before 18.09.2 and other products. An attacker who can run a command as root in a container, either by starting a new container from an attacker-controlled image or by using docker exec on an existing container they already have write access to, can overwrite the host runc binary and gain root access on the host.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:41Z"},"cvss":null,"epss":{"score":0.98452,"percentile":0.99919,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-08-25","exploitedFirstSeen":"2022-08-25","ransomware":false,"evidence":[{"url":"https://www.cloudsek.com/threatintelligence/timeline-ttps-of-teamtnt-cybercrime-group","date":"2022-08-25"},{"url":"https://securelist.com/container-attack-vectors/120010/","date":"2026-06-01"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"Container Breakouts: Escape Techniques in Cloud Environments","url":"https://otx.alienvault.com/pulse/669c0d4c2e7c99bbcf906d65","created":"2024-07-20"},{"name":"Thor Lite Scanner - Cigabuntu (Parrot Version) vs. The Book of Shadows","url":"https://otx.alienvault.com/pulse/666ac558d08da6cfb3ba135b","created":"2024-06-13"},{"name":"Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'","url":"https://otx.alienvault.com/pulse/6668b85065eec626e4766a38","created":"2024-06-11"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"},{"name":"TNT Team","url":"https://otx.alienvault.com/pulse/6214deb0d11d93e5ab93b528","created":"2022-02-22"},{"name":"TeamTNT Cryptomining Explosion","url":"https://otx.alienvault.com/pulse/6213ad9cfa105eaa69e553d2","created":"2022-02-21"},{"name":"Log4j","url":"https://otx.alienvault.com/pulse/61df005d9f0ff216afd15bdc","created":"2022-01-12"},{"name":"Ransomware: Night Sky","url":"https://otx.alienvault.com/pulse/61deff0101737ee62817cbd7","created":"2022-01-12"},{"name":"Hildegard: New TeamTNT Malware Targeting Kubernetes","url":"https://otx.alienvault.com/pulse/601ad65bb1f0c3f6116d20ab","created":"2021-02-03"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2019:0408","tags":["vendor-advisory"]},{"url":"https://github.com/rancher/runc-cve","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2019:0401","tags":["vendor-advisory"]},{"url":"https://github.com/docker/docker-ce/releases/tag/v18.09.2","tags":[]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_06","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20190307-0008/","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2019:0303","tags":["vendor-advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc","tags":["vendor-advisory"]},{"url":"https://github.com/q3k/cve-2019-5736-poc","tags":[]},{"url":"https://www.exploit-db.com/exploits/46359/","tags":["exploit"]},{"url":"https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b","tags":[]},{"url":"https://aws.amazon.com/security/security-bulletins/AWS-2019-002/","tags":[]},{"url":"https://www.openwall.com/lists/oss-security/2019/02/11/2","tags":[]},{"url":"https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/","tags":[]},{"url":"https://access.redhat.com/security/cve/cve-2019-5736","tags":[]},{"url":"https://www.exploit-db.com/exploits/46369/","tags":["exploit"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0304","tags":["vendor-advisory"]},{"url":"https://github.com/Frichetten/CVE-2019-5736-PoC","tags":[]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_us","tags":[]},{"url":"https://brauner.github.io/2019/02/12/privileged-containers.html","tags":[]},{"url":"https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/","tags":[]},{"url":"https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc","tags":[]},{"url":"http://www.securityfocus.com/bid/106976","tags":["vdb-entry"]},{"url":"https://access.redhat.com/security/vulnerabilities/runcescape","tags":[]},{"url":"https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html","tags":[]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1121967","tags":[]},{"url":"https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706%40%3Cuser.mesos.apache.org%3E","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2019/03/23/1","tags":["mailing-list"]},{"url":"https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003","tags":[]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/","tags":["vendor-advisory"]},{"url":"https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2019:0975","tags":["vendor-advisory"]},{"url":"https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/","tags":[]},{"url":"https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/","tags":[]},{"url":"https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e%40%3Cdev.dlab.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46%40%3Cdev.dlab.apache.org%3E","tags":["mailing-list"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/28/2","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/06/3","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/06/4","tags":["mailing-list"]},{"url":"https://usn.ubuntu.com/4048-1/","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/","tags":["vendor-advisory"]},{"url":"https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3%40%3Cdev.dlab.apache.org%3E","tags":["mailing-list"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/10/24/1","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2019/10/29/3","tags":["mailing-list"]},{"url":"https://security.gentoo.org/glsa/202003-21","tags":["vendor-advisory"]},{"url":"https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587%40%3Cdev.dlab.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","tags":["mailing-list"]},{"url":"http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html","tags":[]},{"url":"http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2024/01/31/6","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2024/02/01/1","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2024/02/02/3","tags":["mailing-list"]}],"techniques":[{"id":"T1610","name":"Deploy Container","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: attacker runs commands inside container","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"a command as root within one of these types of containers","start":206,"end":263}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: container escape to host root","mappingType":"primary_impact","evidence":[{"from":"description","quote":"overwrite the host runc binary (and consequently obtain host root access)","start":95,"end":168}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-fd5ae030c97cc60813c6","title":"Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/","date":"2021-02-03","mentions":[{"quote":"BOtB can perform a container breakout using a known vulnerability such as CVE-2019-5736.","start":6862,"end":6950}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-15309","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-15309","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46359,"url":"https://www.exploit-db.com/exploits/46359","title":"runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (1)","type":"local","platform":"linux","date":"2019-02-12","verified":false,"provenance":"source"},{"id":46369,"url":"https://www.exploit-db.com/exploits/46369","title":"runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)","type":"local","platform":"linux","date":"2019-02-13","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-02-12"},"pocGithub":{"count":17,"skipped":11,"earliest":"2019-02-12","earliestUrl":"https://github.com/q3k/cve-2019-5736-poc","repos":[{"name":"Frichetten/CVE-2019-5736-PoC","url":"https://github.com/Frichetten/CVE-2019-5736-PoC","stars":659,"created":"2019-02-13"},{"name":"q3k/cve-2019-5736-poc","url":"https://github.com/q3k/cve-2019-5736-poc","stars":211,"created":"2019-02-12"},{"name":"twistlock/RunC-CVE-2019-5736","url":"https://github.com/twistlock/RunC-CVE-2019-5736","stars":86,"created":"2019-02-20"},{"name":"jas502n/CVE-2019-5736","url":"https://github.com/jas502n/CVE-2019-5736","stars":14,"created":"2019-02-14"},{"name":"agppp/cve-2019-5736-poc","url":"https://github.com/agppp/cve-2019-5736-poc","stars":7,"created":"2019-02-15"}]},"metasploit":[{"name":"Docker Container Escape Via runC Overwrite","module":"exploit/linux/local/docker_runc_escape","type":"exploit","disclosureDate":"2019-01-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_runc_escape.rb"}],"first":{"date":"2019-01-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_runc_escape.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46359/","https://www.exploit-db.com/exploits/46369/","https://github.com/q3k/cve-2019-5736-poc","https://github.com/Frichetten/CVE-2019-5736-PoC","http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html","http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html"],"flow":[{"stage":"exploitation","techniques":["T1610"],"provenance":"ai"},{"stage":"primary","techniques":["T1611"],"provenance":"ai"}],"timeline":[{"date":"2019-01-01","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-02-12, PoC-in-GitHub 2019-02-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/docker_runc_escape.rb","provenance":"source"},{"date":"2019-02-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-5736","provenance":"source"},{"date":"2021-02-03","kind":"report","label":"Named in unit42.paloaltonetworks.com: Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/","provenance":"machine"},{"date":"2022-08-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cloudsek.com/threatintelligence/timeline-ttps-of-teamtnt-cybercrime-group","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":66.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1528 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 4 NVD exploit links; 17 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-opencontainers-runc-cve-2016-9962","parents":[{"from":"CVE-2016-9962","to":"CVE-2019-5736","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["libcontainer/nsenter/nsexec.c"],"commits":["https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5","https://github.com/opencontainers/runc/commit/5d93fed3d27f1e2bab58bad13b180a7a81d0b378","https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d","https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b"],"basis":"shared function","functions":["nsexec"]}]}],"children":[{"from":"CVE-2019-5736","to":"CVE-2020-14298","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304.","from":"CVE.org","in":"CVE-2020-14298"}]},{"from":"CVE-2019-5736","to":"CVE-2021-43784","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["libcontainer/nsenter/nsexec.c"],"commits":["https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d","https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b","https://github.com/opencontainers/runc/commit/9c444070ec7bb83995dbc0185da68284da71c554","https://github.com/opencontainers/runc/commit/d72d057ba794164c3cce9451a00b72a78b25e1ae"],"basis":"shared function","functions":["nsexec"]}]},{"from":"CVE-2019-5736","to":"CVE-2019-12499","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"This is similar to CVE-2019-5736.","from":"CVE.org","in":"CVE-2019-12499"}]}]}}