CopyEscape — PoC for CVE-2026-17106

Educational Proof of Concept of CopyEscape (CVE-2026-17106), a TOCTOU race condition vulnerability in docker cp that allows a malicious container to write arbitrary files on the Docker host. Inspired by the original work of masasron, who discovered and documented the vulnerability in the blog post "CopyEscape: Taking Over Docker Hosts with docker cp".

---

Table of contents

1. Executive summary
2. Legal notice
3. Chain architecture
4. Requirements
5. Repository structure
6. Quick usage guide
7. Exploitation verification
8. Comparison with the original
9. Mitigation
10. Credits
11. License

---

Executive summary

CVE-2026-17106 is a race condition vulnerability (TOCTOU) in the tar file extraction that the Docker daemon produces during docker cp <contenedor>:<ruta> <destino>. It affects Docker CLI 29.6.1 and earlier versions; patched as of 29.7.0. The bug resides in the CLI (host-side tar extraction), not in the daemon.

The chain dubbed CopyEscape demonstrates how, starting solely from a running container with no extra capabilities, an attacker can:

1. Camouflage a real directory /watched/file.txt/ as a regular file to any process that opens it inside the container, using an LD_PRELOAD library that intercepts open, openat, openat2, fopen, stat, lstat, fstatat, statx, and the 64 variants.
2. Keep a 16 MiB decoy file aaa.txt that forces the daemon to take long enough to produce the tar for the monitor to win the race.
3. Monitor daemon accesses with inotify and, during the race window, replace an escape/ subdirectory with an absolute symlink to the host target (/Users/<usuario> on macOS or /usr/bin on Linux) using two atomic rename(2) calls with rollback.
4. The resulting tar contains the escape symlink followed by a child entry escape/<basename>; the vulnerable CLI creates the symlink on the client and extracts the child entry through it, writing outside the destination chosen by the user.

The result is arbitrary file write on the host with the permissions of the process running docker cp. The Linux variant overwrites /usr/bin/runc and achieves root code execution on the host at the next docker run / exec.

---

Legal notice

This repository contains strictly educational and defensive material.

• Purpose: demonstrate the exploitation chain for training, self-auditing, and validating patches.
• Authorized use: run it only against systems you own or for which you have explicit written authorization.
• Prohibited: any use against third-party systems without consent. The repository author is not responsible for misuse of the material included here.
• Responsibility: the operator is solely responsible for compliance with applicable legislation (LOPD/GDPR in Spain, CFAA in the USA, etc.).
• The Linux variant destroys the host's runc: use it only in a disposable VM with a verified backup.

The PoC ships with a harmless macOS variant (writes ~/pwnd as a marker) whose sole purpose is to serve as a reproducible demonstration.

---

Chain architecture

┌─────────────────────────────────────────────────────────────────────┐
│  1. LD_PRELOAD camufla /watched/file.txt como archivo regular       │
│     open/openat/openat2/fopen/stat/lstat/fstatat/statx → decoy       │
│     docker exec ... cat /watched/file.txt  →  "top-level file"       │
└──────────────────────────────────────────┬──────────────────────────┘
                                           │
                                           ▼
┌─────────────────────────────────────────────────────────────────────┐
│  2. Layout real dentro del contenedor                               │
│     /watched/file.txt/                                               │
│     ├── aaa.txt            (16 MiB de 'B', cebo lento)               │
│     ├── escape/            (directorio real inicial)                 │
│     ├── escape/<basename>  (payload: runc o pwnd)                    │
│     └── .swap-escape       (symlink → /Users/<usr> o /usr/bin)       │
└──────────────────────────────────────────┬──────────────────────────┘
                                           │
                                           ▼
┌─────────────────────────────────────────────────────────────────────┐
│  3. docker cp pide tar al daemon                                    │
│     daemon recorre /watched/file.txt/ y abre aaa.txt                │
│     inotify detecta IN_OPEN sobre aaa.txt                           │
└──────────────────────────────────────────┬──────────────────────────┘
                                           │
                                           ▼
┌─────────────────────────────────────────────────────────────────────┐
│  4. Monitor pivot: dos rename(2) atomicos con rollback              │
│     escape/ → .old-escape/   (backup)                                │
│     .swap-escape → escape/   (symlink al target del host)            │
└──────────────────────────────────────────┬──────────────────────────┘
                                           │
                                           ▼
┌─────────────────────────────────────────────────────────────────────┐
│  5. Tar resultante contiene:                                        │
│     escape → /Users/<usr>   (symlink absoluto)                       │
│     escape/<basename>        (entrada hija que atraviesa el symlink) │
└──────────────────────────────────────────┬──────────────────────────┘
                                           │
                                           ▼
┌─────────────────────────────────────────────────────────────────────┐
│  6. CLI vulnerable extrae symlink + hija                            │
│     crea escape → /Users/<usr> en el destino local                   │
│     extrae escape/<basename> A TRAVES del symlink                    │
│     escribe /Users/<usr>/<basename> en el host                       │
└──────────────────────────────────────────┬──────────────────────────┘
                                           │
                                           ▼
┌─────────────────────────────────────────────────────────────────────┐
│  macOS: ~/pwnd con "COPYESCAPE_MACOS_DEMO"  (demo inocua)           │
│  Linux: /usr/bin/runc sobrescrito          (RCE como root)          │
└─────────────────────────────────────────────────────────────────────┘

---

Requirements

The PoC is built to run on macOS with:

• Docker Desktop 4.81+ running (the daemon can be any version; the bug is in the CLI).
• curl, tar, git, and docker in PATH.
• Internet connection to download the vulnerable CLI 29.6.1 (about 18 MB) and the base image alpine:3.21.
• HOME shaped like /Users/<usuario>.

No root is needed for the macOS variant. The Linux variant requires root and a disposable VM.

The run-poc.sh runner automatically downloads the vulnerable CLI 29.6.1 binary from Docker's official site (download.docker.com). It does not modify the system's Docker Desktop installation: it uses the current daemon but invokes the downloaded binary for the docker cp operation.

---

Repository structure

POC CopyEscape (CVE-2026-17106)/
├── README.md                 ← Este archivo
├── LICENSE                   ← Licencia MIT
├── .gitignore
├── Dockerfile                ← Dockerfile unificado (macos | linux)
├── entrypoint.sh             ← Arranque del monitor sin LD_PRELOAD
├── monitor.c                 ← Monitor inotify unificado (una sola fuente)
├── watched_preload.c         ← LD_PRELOAD con cobertura ampliada
└── run-poc.sh                ← Runner robusto con reintentos