Attacker Value
Unknown
CVE-2019-5736
CVE-2019-5736
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Metasploit Module
Description
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
8.6 High
Impact Score:
6
Exploitability Score:
1.8
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Changed
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- apache,
- canonical,
- d2iq,
- docker,
- fedoraproject,
- google,
- hp,
- linuxcontainers,
- linuxfoundation,
- microfocus,
- netapp,
- opensuse,
- redhat
Products
- backports sle 15.0,
- container development kit 3.7,
- dc/os,
- docker,
- enterprise linux 8.0,
- enterprise linux server 7.0,
- fedora 29,
- fedora 30,
- hci management node -,
- kubernetes engine,
- kubernetes engine -,
- leap 15.0,
- leap 15.1,
- leap 42.3,
- lxc,
- mesos,
- onesphere -,
- openshift 3.4,
- openshift 3.5,
- openshift 3.6,
- openshift 3.7,
- runc,
- runc 1.0.0,
- service management automation 2018.02,
- service management automation 2018.05,
- service management automation 2018.08,
- service management automation 2018.11,
- solidfire -,
- ubuntu linux 16.04,
- ubuntu linux 18.04,
- ubuntu linux 18.10,
- ubuntu linux 19.04
Metasploit Modules
References
Advisory
Miscellaneous
